Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package qt6-serialport for openSUSE:Factory
checked in at 2026-10-18 19:21:37
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/qt6-serialport (Old)
and /work/SRC/openSUSE:Factory/.qt6-serialport.new.3698736 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "qt6-serialport"
Sun Oct 18 19:21:37 2026 rev:38 rq:1384412 version:6.12.0
Changes:
--------
--- /work/SRC/openSUSE:Factory/qt6-serialport/qt6-serialport.changes
2026-08-21 16:52:17.003756505 +0200
+++
/work/SRC/openSUSE:Factory/.qt6-serialport.new.3698736/qt6-serialport.changes
2026-10-18 19:21:52.508156207 +0200
@@ -1,0 +2,6 @@
+Wed Sep 30 16:17:11 UTC 2026 - Christophe Marin <[email protected]>
+
+- Update to 6.12.0
+ https://www.qt.io/blog/qt-6.12-released
+
+-------------------------------------------------------------------
Old:
----
qtserialport-everywhere-src-6.11.2.tar.xz
New:
----
qtserialport-everywhere-src-6.12.0.tar.xz
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ qt6-serialport.spec ++++++
--- /var/tmp/diff_new_pack.7zY1U6/_old 2026-10-18 19:21:53.269187758 +0200
+++ /var/tmp/diff_new_pack.7zY1U6/_new 2026-10-18 19:21:53.271187841 +0200
@@ -16,8 +16,8 @@
#
-%define real_version 6.11.2
-%define short_version 6.11
+%define real_version 6.12.0
+%define short_version 6.12
%define tar_name qtserialport-everywhere-src
%define tar_suffix %{nil}
#
@@ -27,7 +27,7 @@
%endif
#
Name: qt6-serialport%{?pkg_suffix}
-Version: 6.11.2
+Version: 6.12.0
Release: 0
Summary: Qt 6 SerialPort library
License: GPL-2.0-only OR LGPL-3.0-only OR GPL-3.0-only
++++++ qtserialport-everywhere-src-6.11.2.tar.xz ->
qtserialport-everywhere-src-6.12.0.tar.xz ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/qtserialport-everywhere-src-6.11.2/.cmake.conf
new/qtserialport-everywhere-src-6.12.0/.cmake.conf
--- old/qtserialport-everywhere-src-6.11.2/.cmake.conf 2026-08-11
19:38:23.000000000 +0200
+++ new/qtserialport-everywhere-src-6.12.0/.cmake.conf 2026-09-26
12:11:43.000000000 +0200
@@ -1,4 +1,4 @@
-set(QT_REPO_MODULE_VERSION "6.11.2")
+set(QT_REPO_MODULE_VERSION "6.12.0")
set(QT_REPO_MODULE_PRERELEASE_VERSION_SEGMENT "alpha1")
set(QT_EXTRA_INTERNAL_TARGET_DEFINES "QT_NO_QASCONST=1")
list(APPEND QT_EXTRA_INTERNAL_TARGET_DEFINES "QT_NO_FOREACH=1")
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/qtserialport-everywhere-src-6.11.2/.tag
new/qtserialport-everywhere-src-6.12.0/.tag
--- old/qtserialport-everywhere-src-6.11.2/.tag 2026-08-11 19:38:23.000000000
+0200
+++ new/qtserialport-everywhere-src-6.12.0/.tag 2026-09-26 12:11:43.000000000
+0200
@@ -1 +1 @@
-1bc5803a397f1f22b7b305a751f78ad1c6997cc4
+beb4c887f3b886447cf86592fa65b8b9c1d6e312
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/qtserialport-everywhere-src-6.11.2/CONTRIBUTING.md
new/qtserialport-everywhere-src-6.12.0/CONTRIBUTING.md
--- old/qtserialport-everywhere-src-6.11.2/CONTRIBUTING.md 1970-01-01
01:00:00.000000000 +0100
+++ new/qtserialport-everywhere-src-6.12.0/CONTRIBUTING.md 2026-09-26
12:11:43.000000000 +0200
@@ -0,0 +1,11 @@
+## Qt contribution guidelines
+
+We welcome contributions to Qt!
+
+Note that we cannot accept pull requests on GitHub. All contributions
+to the Qt project are exclusively handled through the
+[Gerrit code review system](https://codereview.qt-project.org).
+
+See
+[contribute.qt-project.org](https://contribute.qt-project.org/) to learn
+more.
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/qtserialport-everywhere-src-6.11.2/REUSE.toml
new/qtserialport-everywhere-src-6.12.0/REUSE.toml
--- old/qtserialport-everywhere-src-6.11.2/REUSE.toml 2026-08-11
19:38:23.000000000 +0200
+++ new/qtserialport-everywhere-src-6.12.0/REUSE.toml 2026-09-26
12:11:43.000000000 +0200
@@ -29,7 +29,8 @@
SPDX-License-Identifier = "LicenseRef-Qt-Commercial OR BSD-3-Clause"
[[annotations]]
-path = ["**/doc/images/**", "**/README*", "**.qdocconf",
"src/serialport/doc/style/style.css"]
+path = ["**/doc/images/**", "**.qdocconf",
"src/serialport/doc/style/style.css",
+ "**/README*", "CONTRIBUTING.md"]
comment = "documentation"
precedence = "closest"
SPDX-FileCopyrightText = "Copyright (C) The Qt Company Ltd."
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/qtserialport-everywhere-src-6.11.2/dependencies.yaml
new/qtserialport-everywhere-src-6.12.0/dependencies.yaml
--- old/qtserialport-everywhere-src-6.11.2/dependencies.yaml 2026-08-11
19:38:23.000000000 +0200
+++ new/qtserialport-everywhere-src-6.12.0/dependencies.yaml 2026-09-26
12:11:43.000000000 +0200
@@ -1,4 +1,4 @@
dependencies:
../qtbase:
- ref: ef55f427f2c8b410d34f8a7681020a3000cf6866
+ ref: 025bdad181de241e81bf853c8a2d7bf3d19261a9
required: true
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/qtserialport-everywhere-src-6.11.2/licenseRule.json
new/qtserialport-everywhere-src-6.12.0/licenseRule.json
--- old/qtserialport-everywhere-src-6.11.2/licenseRule.json 2026-08-11
19:38:23.000000000 +0200
+++ new/qtserialport-everywhere-src-6.12.0/licenseRule.json 2026-09-26
12:11:43.000000000 +0200
@@ -57,9 +57,10 @@
}
},
{
- "comment": "Files with the following endings are Documentation
licensed.",
- "file_pattern_ending": [".qdoc", ".qdocinc" , ".qdocconf", "README",
"qt_attribution.json",
- ".css"],
+ "comment": "Files with the following endings are documentation
licensed.",
+ "file_pattern_ending": [".qdoc", ".qdocinc" , ".qdocconf", ".css",
+ "README", "CONTRIBUTING.md",
+ "qt_attribution.json"],
"location":{
"": {
"comment": "",
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/qtserialport-everywhere-src-6.11.2/src/serialport/doc/src/index.qdoc
new/qtserialport-everywhere-src-6.12.0/src/serialport/doc/src/index.qdoc
--- old/qtserialport-everywhere-src-6.11.2/src/serialport/doc/src/index.qdoc
2026-08-11 19:38:23.000000000 +0200
+++ new/qtserialport-everywhere-src-6.12.0/src/serialport/doc/src/index.qdoc
2026-09-26 12:11:43.000000000 +0200
@@ -47,6 +47,7 @@
\list
\li \l{Qt Serial Port C++ Classes}{C++ Classes}
\li \l{Qt Serial Port Examples}{Examples}
+ \li \l{Qt Serial Port Security Considerations}{Security Considerations}
\endlist
*/
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/qtserialport-everywhere-src-6.11.2/src/serialport/doc/src/qtserialport-security.qdoc
new/qtserialport-everywhere-src-6.12.0/src/serialport/doc/src/qtserialport-security.qdoc
---
old/qtserialport-everywhere-src-6.11.2/src/serialport/doc/src/qtserialport-security.qdoc
1970-01-01 01:00:00.000000000 +0100
+++
new/qtserialport-everywhere-src-6.12.0/src/serialport/doc/src/qtserialport-security.qdoc
2026-09-26 12:11:43.000000000 +0200
@@ -0,0 +1,73 @@
+// Copyright (C) 2026 The Qt Company Ltd.
+// SPDX-License-Identifier: LicenseRef-Qt-Commercial OR
GFDL-1.3-no-invariants-only
+
+/*!
+ \page qtserialport-security.html
+ \title Qt Serial Port Security Considerations
+ \ingroup security-considerations
+ \brief How to prevent security problems when using Qt Serial Port.
+
+ This page highlights potential security issues that can arise when using
+ the module and suggests how to avoid them.
+
+ \section1 Verify a port name
+
+ QSerialPort accepts a port name as a plain string and performs no
+ validation before trying to open it as a serial device.
+
+ An attacker-controlled name can therefore make the application open an
+ arbitrary file, a device node, or even a remote SMB share. In the first two
+ cases the file is closed immediately after QSerialPort detects that it is
+ not a serial device. The SMB case is different: authentication material is
+ sent to the remote server while the file is being opened, so it can leak
+ even if the open attempt ultimately fails.
+
+ To prevent this, do not use the APIs that take the name of the port as a
+ QString, and prefer those that use QSerialPortInfo:
+
+ \list
+ \li When developing a user interface, enumerate the available ports using
+ \l {QSerialPortInfo::availablePorts()} and let users choose from the
+ list.
+ \li When processing an arbitrary input string, construct a
QSerialPortInfo
+ instance from it, and use \l {QSerialPortInfo::isNull()} to check
+ whether it refers to an existing port.
+ \endlist
+
+ \section1 Limit input and output buffers
+
+ By default, QSerialPort does not limit the size of the input and output
+ buffers. Unrestricted buffers can exhaust the available memory, which is
+ especially problematic on memory-constrained embedded devices.
+
+ If the remote device sends data faster than the application processes it,
+ the read buffer might grow indefinitely. Use
+ \l {QSerialPort::setReadBufferSize()} to limit it. Once the limit is
+ reached, QSerialPort stops reading from the device until the application
+ consumes the buffered data, so incoming data can be lost if the driver's
+ own buffer overflows in the meantime.
+
+ Similarly, if the application writes data faster than the driver can send
+ it, the write buffer might grow indefinitely. Use
+ \l {QSerialPort::setWriteBufferSize()} to limit it. In that case, the
+ application must check the result of the \l {QSerialPort::write()} call to
+ see how much data was actually accepted, and write the rest later.
+
+ \section1 Be aware of lock files
+
+ \note This section applies only to Unix-like systems.
+
+ QSerialPort uses lock files to determine whether the port is already in use
+ by another process before trying to open it. This is a common practice on
+ Unix, so the format and the location of the lock files are well known, and
+ the directories holding them are usually writable by every user.
+
+ QSerialPort detects and removes stale lock files, but a local attacker can
+ spawn a long-lived process and create a crafted lock file that refers to
it.
+ Such a lock never becomes stale and indefinitely prevents the application
+ from accessing the serial port. The attacker never needs to touch the
serial
+ device itself.
+
+ The only way to protect against this is to make sure that no malicious
actor
+ has access to the system.
+*/
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/qtserialport-everywhere-src-6.11.2/src/serialport/qserialport.cpp
new/qtserialport-everywhere-src-6.12.0/src/serialport/qserialport.cpp
--- old/qtserialport-everywhere-src-6.11.2/src/serialport/qserialport.cpp
2026-08-11 19:38:23.000000000 +0200
+++ new/qtserialport-everywhere-src-6.12.0/src/serialport/qserialport.cpp
2026-09-26 12:11:43.000000000 +0200
@@ -381,6 +381,13 @@
The name of the serial port can be passed as either a short name or
the long system location if necessary.
+ \note This function allows setting ports that are not included in the
+ \l{QSerialPortInfo::availablePorts()}{list of available ports}, or where
+ constructing a QSerialPortInfo instance with the name string yields a
+ \l{QSerialPortInfo::isNull}{null} object. If that is not a requirement,
then
+ use setPort() instead after checking that the name results in a valid
+ QSerialPortInfo object.
+
\sa portName(), QSerialPortInfo
*/
void QSerialPort::setPortName(const QString &name)
@@ -1020,6 +1027,9 @@
port should be protected against receiving too much data, which may
eventually cause the application to run out of memory.
+ Passing a negative value disables the internal buffer, effectively blocking
+ any reads.
+
\sa readBufferSize(), read()
*/
void QSerialPort::setReadBufferSize(qint64 size)
@@ -1052,24 +1062,26 @@
Sets the size of QSerialPort's internal write buffer to be \a
size bytes.
- Sending the data over serial port is relatively slow, so in practice, when
- \l write() is called, the data is not sent immediately. It is first stored
- in an intermediate buffer and later written in chunks.
-
- Thus, an attempt to write too much data or write data at a higher rate than
- the underlying serial port can handle, can lead to a situation when the
- internal buffer will grow. This can eventually cause the application to
- run out of memory, specially on a device with low memory resources.
+ Sending data over a serial port is relatively slow, so in practice the data
+ is not sent immediately when \l write() is called. It is first stored in an
+ intermediate buffer and later written in chunks.
+
+ Thus, writing too much data, or writing it at a higher rate than the
+ underlying serial port can handle, can make the internal buffer grow. This
+ can eventually cause the application to run out of memory, especially on a
+ device with low memory resources.
- This method allows to limit the internal buffer to a certain size. If the
+ This method allows limiting the internal buffer to a certain size. If the
next write attempt exceeds the capacity of the buffer, the \l write()
- method will return the amount of bytes that were actually stored in the
- buffer. It's the user's responsibility to repeat the write attempt with the
- rest of the bytes after the \l bytesWritten() signal was received, or after
- the \l waitForBytesWritten() method returns \c true.
+ method returns the number of bytes that were actually stored in the buffer.
+ It is the user's responsibility to repeat the write attempt with the rest
+ of the bytes after the \l bytesWritten() signal is received, or after the
+ \l waitForBytesWritten() method returns \c true.
+
+ Passing \c 0 to this method means that the write buffer is not limited, and
+ all the data passed to \l write() is buffered. This is the default.
- Passing \c 0 to this method means that the input buffer is not limited, and
- all the incoming data is buffered. This is the default.
+ Passing a negative value has the same effect as passing \c 0.
\sa writeBufferSize(), write()
*/
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/qtserialport-everywhere-src-6.11.2/src/serialport/qserialportinfo_freebsd.cpp
new/qtserialport-everywhere-src-6.12.0/src/serialport/qserialportinfo_freebsd.cpp
---
old/qtserialport-everywhere-src-6.11.2/src/serialport/qserialportinfo_freebsd.cpp
2026-08-11 19:38:23.000000000 +0200
+++
new/qtserialport-everywhere-src-6.12.0/src/serialport/qserialportinfo_freebsd.cpp
2026-09-26 12:11:43.000000000 +0200
@@ -101,6 +101,12 @@
size_t requiredLength = 0;
if (::sysctl(&mib[0], mib.count(), nullptr, &requiredLength, nullptr, 0) <
0)
return QList<int>();
+ // The returned length should not be zero, and should contain
+ // the whole amount of ints (OID components). Otherwise the next
+ // sysctl() call will either dereference the non-existing element
+ // or use the wrong length
+ if (requiredLength == 0 || requiredLength % sizeof(int) != 0)
+ return QList<int>();
const size_t oidLength = requiredLength / sizeof(int);
QList<int> oid(oidLength, 0);
if (::sysctl(&mib[0], mib.count(), &oid[0], &requiredLength, nullptr, 0) <
0)
@@ -262,16 +268,16 @@
const QString descnode =
QString(QLatin1String("%1\%desc")).arg(nodebase);
// search for description and manufacturer properties
- for (const NodeInfo &node : nodes) {
- if (node.name != descnode)
+ for (const NodeInfo &descriptionNode : nodes) {
+ if (descriptionNode.name != descnode)
continue;
- if (node.value.isEmpty())
+ if (descriptionNode.value.isEmpty())
continue;
// We can not separate the description and the manufacturer
// properties from the node value, so lets just duplicate it.
- priv.description =
deviceDescriptionAndManufacturer(node.value);
+ priv.description =
deviceDescriptionAndManufacturer(descriptionNode.value);
priv.manufacturer = priv.description;
break;
}
