From 7cd8b4791d9c3028d44161f6e21878802e824481 Mon Sep 17 00:00:00 2001 From: Bernd Kuhls Date: Thu, 2 Apr 2026 20:05:34 +0200 Subject: [PATCH] package/xz: security bump version to 5.8.3 https://github.com/tukaani-project/xz/releases/tag/v5.8.3 Fixes CVE-2026-34743. Switched to sha256 tarball provided by upstream. Signed-off-by: Bernd Kuhls Signed-off-by: Julien Olivain (cherry picked from commit 724635227314010518372c5bad4d37d7c58950c1) Signed-off-by: Thomas Perale --- package/xz/xz.hash | 6 ++---- package/xz/xz.mk | 2 +- 2 files changed, 3 insertions(+), 5 deletions(-) diff --git a/package/xz/xz.hash b/package/xz/xz.hash index 99daa5e9df..488a3d55dc 100644 --- a/package/xz/xz.hash +++ b/package/xz/xz.hash @@ -1,7 +1,5 @@ -# Locally calculated after checking pgp signature -# https://github.com/tukaani-project/xz/releases/download/v5.8.2/xz-5.8.2.tar.bz2.sig -# using key 3690C240CE51B4670D30AD1C38EE757D69184620 Lasse Collin -sha256 60345d7c0b9c8d7ffa469e96898c300def3669f5047fc76219b819340839f3d8 xz-5.8.2.tar.bz2 +# From https://github.com/tukaani-project/xz/releases/tag/v5.8.3 +sha256 33bf69c0d6c698e83a68f77e6c1f465778e418ca0b3d59860d3ab446f4ac99a6 xz-5.8.3.tar.bz2 # Hash for license files sha256 616a3ad264ce29b8f1cb97e53037b139d406899ca8d1f799651e17bfa09830b8 COPYING diff --git a/package/xz/xz.mk b/package/xz/xz.mk index 8aa0716b18..91eedd7a83 100644 --- a/package/xz/xz.mk +++ b/package/xz/xz.mk @@ -4,7 +4,7 @@ # ################################################################################ -XZ_VERSION = 5.8.2 +XZ_VERSION = 5.8.3 XZ_SOURCE = xz-$(XZ_VERSION).tar.bz2 XZ_SITE = https://github.com/tukaani-project/xz/releases/download/v$(XZ_VERSION) XZ_INSTALL_STAGING = YES