import Oracle_OSS qt6-qtdeclarative-6.10.1-1.el10_2.1

.gitignore

@@ -1,32 +1 @@
-/qtdeclarative-everywhere-src-6.0.0.tar.xz
-/qtdeclarative-everywhere-src-6.0.1.tar.xz
-/qtdeclarative-everywhere-src-6.0.3.tar.xz
-/qtdeclarative-everywhere-src-6.1.0.tar.xz
-/qtdeclarative-everywhere-src-6.1.1.tar.xz
-/qtdeclarative-everywhere-src-6.1.2.tar.xz
-/qtdeclarative-everywhere-src-6.2.0-beta3.tar.xz
-/qtdeclarative-everywhere-src-6.2.0-beta4.tar.xz
-/qtdeclarative-everywhere-src-6.2.0-rc.tar.xz
-/qtdeclarative-everywhere-src-6.2.0-rc2.tar.xz
-/qtdeclarative-everywhere-src-6.2.0.tar.xz
-/qtdeclarative-everywhere-src-6.2.1.tar.xz
-/qtdeclarative-everywhere-src-6.2.2.tar.xz
-/qtdeclarative-everywhere-src-6.2.3.tar.xz
-/qtdeclarative-everywhere-src-6.3.0.tar.xz
-/qtdeclarative-everywhere-src-6.3.1.tar.xz
-/qtdeclarative-everywhere-src-6.4.0.tar.xz
-/qtdeclarative-everywhere-src-6.4.1.tar.xz
-/qtdeclarative-everywhere-src-6.4.2.tar.xz
-/qtdeclarative-everywhere-src-6.4.3.tar.xz
-/qtdeclarative-everywhere-src-6.5.0.tar.xz
-/qtdeclarative-everywhere-src-6.5.1.tar.xz
-/qtdeclarative-everywhere-src-6.5.2.tar.xz
-/qtdeclarative-everywhere-src-6.5.3.tar.xz
-/qtdeclarative-everywhere-src-6.6.0.tar.xz
-/qtdeclarative-everywhere-src-6.6.1.tar.xz
-/qtdeclarative-everywhere-src-6.7.0.tar.xz
-/qtdeclarative-everywhere-src-6.7.1.tar.xz
-/qtdeclarative-everywhere-src-6.8.1.tar.xz
-/qtdeclarative-everywhere-src-6.9.0.tar.xz
-/qtdeclarative-everywhere-src-6.9.1.tar.xz
-/qtdeclarative-everywhere-src-6.10.1.tar.xz
+qtdeclarative-everywhere-src-6.10.1.tar.xz

VectorImage-Sanitize-source-string-used-in-output.patch

@@ -1,24 +1,27 @@
 From 1f35339b03fcb8787028e1301012a559328815fb Mon Sep 17 00:00:00 2001
 From: Eskil Abrahamsen Blomfeldt <eskil.abrahamsen-blomfeldt@qt.io>
-Date: Tue, 09 Dec 2025 07:39:32 +0100
+Date: Tue, 9 Dec 2025 07:39:32 +0100
 Subject: [PATCH] VectorImage: Sanitize source string used in output
 
-The source string is used as an object name in the output, so it gets
-sanitized to prevent illegal characters. While SVG already mandates a
-limited character set, rather than relying on the parser, sanitization
-happens before passing to the generator -- consistent with how the
-Lottie visitor handles it.
+The source string is used as an object name in output, so we sanitize
+it to make sure it does not contain illegal characters. SVG already
+mandates a limited character set here, but rather than trust the parser
+we sanitize before passing to the generator, similar to what the Lottie
+visitor does.
 
 Fixes: QTBUG-142556
 Pick-to: 6.8
 Change-Id: I0684e726ab69a0735dcb5f91369b090d58a90b7b
 Reviewed-by: Eirik Aavitsland <eirik.aavitsland@qt.io>
+(cherry picked from commit cfc3e783fed4e876c2c29d008b5ef43c547b16b7)
+(cherry picked from commit ce82a78b0d10703f9b172f9afeb3d5e832e05074)
+Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
 ---
  .../generator/qsvgvisitorimpl.cpp             | 20 ++++++++++++++++++-
  1 file changed, 19 insertions(+), 1 deletion(-)
 
 diff --git a/src/quickvectorimage/generator/qsvgvisitorimpl.cpp b/src/quickvectorimage/generator/qsvgvisitorimpl.cpp
-index 87ce1e80..b7c0dbfe 100644
+index 87ce1e80..fa04daea 100644
 --- a/src/quickvectorimage/generator/qsvgvisitorimpl.cpp
 +++ b/src/quickvectorimage/generator/qsvgvisitorimpl.cpp
 @@ -1101,9 +1101,27 @@ void QSvgVisitorImpl::visitDocumentNodeEnd(const QSvgTinyDocument *node)
@@ -30,7 +33,7 @@ index 87ce1e80..b7c0dbfe 100644
 +    QString res(raw.left(80));
 +
 +    if (!res.isEmpty()) {
-+        constexpr QLatin1StringView legalSymbols("_-.:");
++        constexpr QLatin1StringView legalSymbols("_-.:"); // Only valid SVG id characters
 +        qsizetype i = 0;
 +        do {
 +            if (res.at(i).isLetterOrNumber() || legalSymbols.contains(res.at(i)))
@@ -51,5 +54,4 @@ index 87ce1e80..b7c0dbfe 100644
      info.isDefaultTransform = node->style().transform.isDefault();
      info.transform.setDefaultValue(QVariant::fromValue(!info.isDefaultTransform
 --
-2.53.0
-
+2.48.1

gating.yaml

@@ -1,6 +0,0 @@
---- !Policy
-product_versions:
-  - rhel-10
-decision_context: osci_compose_gate
-rules:
-  - !PassingTestCaseRule {test_case_name: desktop-qe.desktop-ci.tier1-gating.functional}

qt6-qtdeclarative.spec

@@ -17,7 +17,7 @@
 Summary: Qt6 - QtDeclarative component
 Name:    qt6-%{qt_module}
 Version: 6.10.1
-Release: 2%{?dist}
+Release: 1%{?dist}.1
 
 License: LGPL-3.0-only OR GPL-3.0-only WITH Qt-GPL-exception-1.0
 Url:     http://www.qt.io
@@ -40,7 +40,9 @@ Patch0:  qtdeclarative-quickshapes-make-module-public.patch
 
 # CVE-2025-14576
 # https://codereview.qt-project.org/c/qt/qtdeclarative/+/697273
-Patch1:  qtdeclarative-vectorimage-sanitize-source-string-used-in-output.patch
+Patch1:  VectorImage-Sanitize-source-string-used-in-output.patch
+
+## upstreamable patches
 
 # filter qml provides
 %global __provides_exclude_from ^%{_qt6_qmldir}/.*\\.so$
@@ -771,9 +773,9 @@ make check -k -C tests ||:
 %endif
 
 %changelog
-* Tue May 19 2026 Jan Grulich <jgrulich@redhat.com> - 6.10.1-2
+* Wed May 20 2026 Jan Grulich <jgrulich@redhat.com> - 6.10.1-1.1
 - VectorImage: sanitize source string used in output (CVE-2025-14576)
-  Resolves: RHEL-173495
+  Resolves: RHEL-173494
 
 * Mon Nov 24 2025 Jan Grulich <jgrulich@redhat.com> - 6.10.1-1
 - 6.10.1

rpminspect.yaml

@@ -1,13 +0,0 @@
----
-ignore:
-    - '/usr/lib*/qt6/tests/*'
-annocheck:
-    # QT is known not to work properly with LTO at this point.  Some of the issues
-    # are being worked on upstream and disabling LTO should be re-evaluated as
-    # we update this change.  Until such time...
-    # Disable LTO
-    jobs:
-        hardened: --skip-lto
-    ignore:
-        - '/usr/lib*/qt6/examples/*'
-