Commit Graph

78025 Commits

Author SHA1 Message Date
Alexis Lothoré
0413ab036e docs/manual/getting: fix dead link
When searching for the official git repository in the documentation,
readers are forwarded to the buildroot website Download page with a link
pointing to buildroot.org/download, which returns a 404.

Fix the dead link by adding the missing .html suffix.

Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 8845586fc6)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-09-30 11:09:13 +02:00
Peter Korsgaard
b06fe0eb20 package/rtl_433: do not leak Buildroot git info
The CMake build system has logic to detect the git repo info and include it
in the version output.  This unfortunately gets confused and adds the git
info of the Buildroot repository when building inside the repo:

-- Found Git version: refs/heads/rtl_433-25.02 commit a367362af0                                 from 2025-09-21T20:07:58+0200
-- Using Git version tag: 2025.08-283-ga367362af0 on rtl_433-25.02 at 202509212007

rtl_433 -V
rtl_433 version 2025.08-283-ga367362af0 branch rtl_433-25.02 at 202509212007 inputs file rtl_tcp RTL-SDR

Pass GIT_DIR=.  to the configure step similar to how it is already done for
the build step to disable this.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 817611686a)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-09-30 11:09:04 +02:00
Yegor Yefremov
20d4df73fa package/libxmlrpc: add BR2_USE_MMU dependency
Build fails with:
server.c: In function 'ServerDaemonize':
server.c:1590:13: error: implicit declaration of function 'fork'
[-Wimplicit-function-declaration]
 1590 |     switch (fork()) {
      |             ^~~~

Hence, add BR2_USE_MMU to avoid building with toolchains without MMU
support.

Fixes:
https://autobuild.buildroot.org/results/10464159f2a9ff41ea0921a45ce12ecd0fa50ae7/

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
[Julien: move BR2_USE_MMU up to fix check-package error]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 059138326e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-25 21:58:18 +02:00
Romain Naour
2d703d9437 support/testing: GitTestBase: remove git daemon due to Gitlab-CI security settings
TestGitHash and TestGitRefs are failing on Gitlab-CI since 2025-08-18
(first runtime-test failures report for master) [1] due a new Gitlab-CI
security settings that prevents the any use of localhost (127.0.0.1) on
the Gitlab-CI runner [2]:

"To prevent exploitation of insecure internal web services, all webhook
 and integration requests to the following local network addresses are
 not allowed:

 Private network addresses, including 127.0.0.1, ::1, 0.0.0.0,
 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, and IPv6 site-local
 (ffc0::/10) addresses."

Gitlab suggest using a second container as a Services [3] since each
containers have access to one another and can communicate when running
the job. But this is really not practical to run git daemon since the
service is started before the Buildroot git tree is fetched and git
daemon needs git-remote directory content.

See [4]:
"If you have your service that tries to write to CI_PROJECT_DIR
 immediately after it's started - it will not work and fail with an
 error like '/builds/nknapp/gitlab-ci-test/': No such file or directory
 error. Because that directory is most probably not there yet, as the
 job step that creates it is yet to be executed!"

Also, using Gitlab-CI services requires to handle GitTestBase setUp
differently on Gitlab-CI than local use of run-tests.
So Gitlab-CI services is not an option.

We could move support/testing/tests/download/git-remote to our Gitlab
group (https://gitlab.com/buildroot.org) but since it's only intended
for testing the git download backend, we don't really want to do that.

So the only remaining choice to clone the repository from the Buildroot
git tree (local machine).

To do so, we have to do the following changes:

- Replace all "git://localhost:$(GITREMOTE_PORT_NUMBER)" by
  "$(GITREMOTE_DIR)". GITREMOTE_DIR will contain the absolute path to
  tests/download/git-remote directory.

- Force to use git download backend using "SITE_METHOD = git" otherwise
  the download infra will fall back using wget download backend.

- Cloning a git repository with submodules using the "file://" protocol
  needs to be allowed from git config. It's disabled by default:
  "fatal: transport 'file' not allowed"
  Use a local gitconfig file generated by GitTestBase before starting
  TestGitHash and TestGitRefs with:

  [protocol "file"]
    allow = always

  This is considered safe since we are using a git repository from the
  Buildroot git tree.

- Running TestGitHash and TestGitRefs on Gitlab-CI requires additional
  git config settings to disable ownership check of the git tree [5].

Thanks to Arnout for advices about GIT_CONFIG_GLOBAL.

Runtime tested:
https://gitlab.com/kubu93/buildroot/-/jobs/11428504450 (TestGitHash)
https://gitlab.com/kubu93/buildroot/-/jobs/11428490035 (TestGitRefs)

[1] https://lore.kernel.org/buildroot/68a3ee65.500a0220.397724.30db@mx.google.com/
[2] https://docs.gitlab.com/security/webhooks/#allow-requests-to-the-local-network-from-webhooks-and-integrations
[3] https://docs.gitlab.com/ci/services/
[4] https://gitlab.com/gitlab-org/gitlab-runner/-/issues/25982#note_2139685797
[5] a016b693f7

Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/11271124174 (TestGitHash)
https://gitlab.com/buildroot.org/buildroot/-/jobs/11271124173 (TestGitRefs)

Cc: Arnout Vandecappelle <arnout@rnout.be>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit a367362af0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-25 21:58:17 +02:00
Romain Naour
a903cce65c support/testing: TestZfsUclibc: use internal backend for uClibc-ng toolchain
As reported on the mailing list [1] while investigating the
TestZfsUclibc Gitlab-CI failure, the python 3.13 interpreter itsef
segfault at runtime:

  Fatal Python error: _PyThreadState_Attach: non-NULL old thread state
  Python runtime state: preinitialized
  Thread 0xSegmentation fault

This issue is related to the python 3.13 version bump [2] were several
internal changes were added [3] to support PEP 703 [4].
PEP 793 is about CPython’s global interpreter lock (“GIL”) removal
for multi-threads support that requires a working C11 "thread_local"
for thread-local storage [5].

The new uclibc-ng 1.0.55 release contains a fix for this issue [6].
This version is included in Buildroot commit [7].

Since the prebuilt Bootling aarch64 uclibc stable 2025.08-1 is based
on previous uClibc-ng release (1.0.54) we have to use the internal
toolchain backend to build a new uClibc-ng toolchain using uclibc-ng
1.0.55. Note: the toolchain config defined in this commit reflects
the options enabled in the Bootling aarch64 uclibc external
toolchains.

Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/11271124859 (TestZfsUclibc)

[1] https://lore.kernel.org/buildroot/7a4d245d-1556-43c9-8997-6b1f791afbfe@gmail.com/ (TestZfsUclibc)
[2] d63e207eb8
[3] 6e97a9647a
[4] https://peps.python.org/pep-0703/
[5] https://gcc.gnu.org/onlinedocs/gcc-15.1.0/gcc/Thread-Local.html
[6] 94c1297d52
[7] 5250bba8e5

Cc: José Luis Salvador Rufo <salvador.joseluis@gmail.com>
Tested-by: José Luis Salvador Rufo <salvador.joseluis@gmail.com>
Cc: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
[Julien:
 - add link to buildroot commit updating uclibc-ng to 1.0.55
 - add a note in the commit log about the toolchain config
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 5208b7a1bd)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-25 21:58:16 +02:00
Dario Binacchi
507d71236a package/atop: security bump to version 2.11.1
This bump includes the security fix for CVE-2025-31160.

Release notes:
https://www.atoptool.nl/downloadatop.php

Fixes:
https://www.cve.org/CVERecord?id=CVE-2025-31160

Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
[Julien:
 - add "security" in commit log title
 - add link to CVE
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 45e7fe2811)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-25 21:58:15 +02:00
Waldemar Brodkorb
e716ef5295 package/uclibc: bump to 1.0.55
Finally the aarch64 tls bug is fixed. (python 3.13 segfault)
Unfortunately it is not covered by any testcase of uClibc-ng-test.

Here is the git shortlog for the release:

Marius Melzer (1):
      malloc-standard: Fix truncation problem in malloc

Waldemar Brodkorb (5):
      Fix Sysvipc for ARM, AARCH64, RISCV64, KVX and m68k
      remove uClibc specific gettext_printf
      aarch64: do not force tls-model in CPU_CFLAGS, this isn't required
      aarch64: respect r_addend for TLSDESC relocations
      bump version for 1.0.55 release

yliu (5):
      mips32: Preventing FORCE_FRAME_POINTER from being optimized away
      mips32: Define __IPC_64 according to kernel version
      time64: fixed msgctl/semctl/shmctl result errors for for MIPS32/RISCV32
      time64: fix *ctl functions in mips32eb/mips64
      time64: fix *ctl functions in mips32eb

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Tested-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 5250bba8e5)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-25 21:58:13 +02:00
Dario Binacchi
a1197e8c5d DEVELOPERS: add Dario Binacchi for cmocka
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 190c482335)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-25 21:58:12 +02:00
Dario Binacchi
9506b78ef1 DEVELOPERS: add Dario Binacchi for atf
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 713fbb1f39)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-25 21:58:11 +02:00
Thomas Perale
f3fec79550 package/poco: add patch for CVE-2025-6375
This fixes the following vulnerability:

- CVE-2025-6375:

A vulnerability was found in poco up to 1.14.1. It has been rated as
problematic. Affected by this issue is the function MultipartInputStream
of the file Net/src/MultipartReader.cpp. The manipulation leads to null
pointer dereference. The attack needs to be approached locally. The
exploit has been disclosed to the public and may be used. Upgrading to
version 1.14.2 is able to address this issue. The patch is identified as
6f2f85913c191ab9ddfb8fae781f5d66afccf3bf. It is recommended to upgrade
the affected component.

For more information see:
  - https://nvd.nist.gov//vuln/detail/CVE-2025-6375
  - 6f2f85913c

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 36357247d5)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-25 21:58:10 +02:00
Maxim Kochetkov
62add70c9f package/postgresql: security bump to version 17.6
Fixes the following security issue:

CVE-2025-8713: PostgreSQL optimizer statistics can expose sampled data
within a view, partition, or child table

PostgreSQL optimizer statistics allow a user to read sampled data within
a view that the user cannot access. Separately, statistics allow a user
to read sampled data that a row security policy intended to hide.
PostgreSQL maintains statistics for tables by sampling data available in
columns; this data is consulted during the query planning process. Prior
to this release, a user could craft a leaky operator that bypassed view
access control lists (ACLs) and bypassed row security policies in
partitioning or table inheritance hierarchies. Reachable statistics data
notably included histograms and most- common-values lists. CVE-2017-7484
and CVE-2019-10130 intended to close this class of vulnerability, but
this gap remained. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19,
and 13.22 are affected.

CVE-2025-8714: PostgreSQL pg_dump lets superuser of origin server execute
arbitrary code in psql client

Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious
superuser of the origin server to inject arbitrary code for restore-time
execution as the client operating system account running psql to restore
the dump, via psql meta-commands. pg_dumpall is also affected. pg_restore
is affected when used to generate a plain-format dump. This is similar to
MySQL CVE-2024-21096. Versions before PostgreSQL 17.6, 16.10, 15.14,
14.19, and 13.22 are affected.

CVE-2025-8715: PostgreSQL pg_dump newline in object name executes
arbitrary code in psql client and in restore target server

Improper neutralization of newlines in pg_dump in PostgreSQL allows a user
of the origin server to inject arbitrary code for restore-time execution
as the client operating system account running psql to restore the dump,
via psql meta-commands inside a purpose-crafted object name. The same
attacks can achieve SQL injection as a superuser of the restore target
server. pg_dumpall, pg_restore, and pg_upgrade are also affected.
Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected.
Versions before 11.20 are unaffected. CVE-2012-0868 had fixed this class
of problem, but version 11.20 reintroduced it.

https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/

Signed-off-by: Maxim Kochetkov <fido_max@inbox.ru>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 4f0a9596e3)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-25 21:58:08 +02:00
Waldemar Brodkorb
7c906832e9 package/x11r7/xapp_xdm: bump to 1.1.17
See here for Changes:
https://lists.x.org/archives/xorg/2025-March/061902.html

Fixes a compile error with gcc 14.x.

COPYRIGHT was updated:
-Copyright (c) 2002, 2006, 2009, 2010, Oracle and/or its affiliates.
-All rights reserved.
+Copyright (c) 2002, 2006, 2009, 2010, 2025, Oracle and/or its affiliates.

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
[Julien: fix COPYING license hash]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit c878e08839)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-25 21:58:07 +02:00
Waldemar Brodkorb
253daff0e7 package/x11r7/xapp_xdm: needs libxcrypt
While doing a per-package build the package is failing to
compile with this error (gcc 13.x glibc toochain):
make[3]: Entering directory
'/home/wbx/buildroot-2025.02.3/output/build/xapp_xdm-1.1.14/xdm'   CC
session.o session.c:146:11: fatal error: crypt.h: No such file or
directory   146 | # include <crypt.h>       |           ^~~~~~~~~
compilation terminated.

Fix this error by providing the needed glibc dependencies.

Fixes:
 https://autobuild.buildroot.org/results/b75/b75ad8f1159613656dce482992c800545d60ae69/

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 2d076a1b76)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-25 21:58:06 +02:00
Thomas Perale
9010ca7b77 package/civetweb: add patch for CVE-2025-55763
This fixes the following vulnerability:

- CVE-2025-55763

Buffer Overflow in the URI parser of CivetWeb 1.14 through 1.16 (latest)
allows a remote attacker to achieve remote code execution via a crafted
HTTP request. This vulnerability is triggered during request processing
and may allow an attacker to corrupt heap memory, potentially leading to
denial of service or arbitrary code execution.

For more information, see:
  - https://nvd.nist.gov//vuln/detail/CVE-2025-55763
  - 76e222bcb7

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 426d7635c7)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-25 21:58:05 +02:00
Thomas Petazzoni
6eb4af270d package/libfreeimage: fix build with GCC 14.x
Take two patches from the Debian jxrlib package, and integrate them to
fix the build of the bundled jxrlib library found in the libfreeimage
package.

libfreeimage isn't exactly well maintained: its last version 3.18.0 is
quite old (July 2018), there's a fairly large number of tickets in the
bug tracker claiming to be CVE
reports (https://sourceforge.net/p/freeimage/bugs/), it is still using
SVN as the version control system.

However, it is used as an optional dependency for CEGUI, and a
mandatory dependency for Ogre. However, it no longer seems to be a
dependency for more recent versions of Ogre. But in any case it cannot
simply be dropped.

Fixes:

  https://autobuild.buildroot.net/results/452462285bf93b13f092fb41696952f415e75b2f/

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 21ea33c764)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-25 21:58:04 +02:00
Thomas Perale
4230193b22 package/jasper: add patch for CVE-2025-8835
This fixes the following vulnerability:

- CVE-2025-8835:

A vulnerability was found in JasPer up to 4.2.5. Affected by this
vulnerability is the function jas_image_chclrspc of the file
src/libjasper/base/jas_image.c of the component Image Color Space
Conversion Handler. The manipulation leads to null pointer dereference.
It is possible to launch the attack on the local host. The exploit has
been disclosed to the public and may be used. The identifier of the
patch is bb7d62bd0a2a8e0e1fdb4d603f3305f955158c52. It is recommended to
apply a patch to fix this issue.

For more information see:
  - https://nvd.nist.gov//vuln/detail/CVE-2025-8835
  - bb7d62bd0a

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 6e81b51f68)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-25 21:58:03 +02:00
Thomas Perale
eb6a93ab86 package/jasper: add patch for CVE-2023-51257
This fixes the following vulnerability:

- CVE-2023-51257:

An invalid memory write issue in Jasper-Software Jasper v.4.1.1 and
before allows a local attacker to execute arbitrary code.

For more information see:
  - https://nvd.nist.gov//vuln/detail/CVE-2023-51257
  - aeef5293c9

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 860c35d1ac)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-25 21:58:02 +02:00
Thomas Perale
42db5653f7 package/lua/5.1.5: add patch for CVE-2014-5461
This CVE is specific for the version 5.1.5 still present in Buildroot.
It has been fixed in 5.2.3 and thereby doesn't affects the other
versions available in Buildroot.

- CVE-2014-5461

Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through
5.2.x before 5.2.3 allows context-dependent attackers to cause a denial
of service (crash) via a small number of arguments to a function with a
large number of fixed arguments.

For more information see:
  - https://security-tracker.debian.org/tracker/CVE-2014-5461
  - https://udd.debian.org/patches.cgi?src=lua5.1&version=5.1.5-11

A patch present in Debian is used to address this vulnerability.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit a2c906ee3b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-25 21:58:01 +02:00
Titouan Christophe
7c03d86be6 package/opencv4 (-contrib): security bump to v4.12.0
This fixes the following vulnerability:
- CVE-2025-53644:
    OpenCV is an Open Source Computer Vision Library. Versions prior to
    4.12.0 have an uninitialized pointer variable on stack that may lead
    to arbitrary heap buffer write when reading crafted JPEG images.
    Version 4.12.0 fixes the vulnerability.
    https://www.cve.org/CVERecord?id=CVE-2025-53644

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 9c365fee97)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-25 21:57:59 +02:00
Bernd Kuhls
f29720f2fd package/{opencv4, opencv4-contrib}: bump version to 4.11.0
Changelog:
https://github.com/opencv/opencv/wiki/OpenCV-Change-Logs#version4110

Added comments to both packages to keep the version number in sync.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 9b9b21f589)
[thomas: including for following security bump in v4.12.0]
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-25 21:57:58 +02:00
Thomas Perale
042bf0e924 package/zziplib: fix deprecated CPE
The CPE 'zziplib_project:zziplib' is deprecated in favour of
'gdraheim:zziplib'.

See https://nvd.nist.gov/products/cpe/detail/FB4124F9-087E-454D-B5D4-642FF08B23A8

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit c9d185e182)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-25 21:57:57 +02:00
Thomas Perale
a4b98a75d9 package/x11r7/xserver_xorg-server: fix deprecated CPE
The CPE 'x.org:xorg-server' is deprecated in favour of
'x.org:x_server'.

See the following:
  - https://nvd.nist.gov/products/cpe/detail/F6729083-29EE-4772-9DFF-80B43980D6BE
  - https://nvd.nist.gov/vuln/detail/CVE-2025-26601

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
[Julien: fix "xorg-server:x_server" to "x.org:x_server" in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 85c71fee3f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-25 21:57:56 +02:00
Thomas Perale
8202a27869 package/python-aiohttp-session: fix deprecated CPE
The CPE 'aiohttp-session_project:aiohttp-session' has been deprecated in
favour of 'aiohttp-session:aiohttp-session'.

See https://nvd.nist.gov/products/cpe/detail/667389BF-3561-49F9-A61A-6C86C7B82922

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
[Julien: add https:// prefix to url in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit fdb540a00e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-25 21:57:55 +02:00
Thomas Perale
397275fc51 package/modsecurity2: fix deprecated CPE
The CPE 'trustwave:modsecurity' has been deprecated in favour of
'owasp:modsecurity'.

See the following:
  - https://nvd.nist.gov/products/cpe/detail/B305D665-44EC-44A6-8C46-C68BFDAD7C38
  - https://nvd.nist.gov/vuln/detail/CVE-2025-48866

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 843707ba1e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-25 21:57:53 +02:00
Thomas Perale
4da319907d package/iputils: fix deprecated CPE
The CPE 'iputils_project:iputils' has been deprecated in favour of
'iputils:iputils'.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 4ac3c1de56)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-25 21:57:52 +02:00
Thomas Perale
c214561573 package/upx: fix deprecated CPE
The CPE 'upx_project:upx' has been deprecated in favour of 'upx:upx'.

See the following:
  - https://nvd.nist.gov/products/cpe/detail/36CA8E94-4A35-4373-8D69-22313060322B
  - https://nvd.nist.gov/vuln/detail/CVE-2020-24119

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit ff492a2c87)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-25 21:57:51 +02:00
Thomas Perale
ab098f0fc5 package/python-cryptography: fix deprecated CPE
The CPE 'cryptography_project:cryptography' has been deprecated in
favour of 'cryptography.io:cryptography'.

See the following:
 - https://nvd.nist.gov/products/cpe/detail/2EBA50FC-F3F9-40D5-82BD-EFB67F761153
 - https://nvd.nist.gov/vuln/detail/cve-2023-49083

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 2f993d55e8)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-25 21:57:50 +02:00
Thomas Perale
8dc5815307 package/pango: fix deprecated CPE
The CPE 'pango:pango' has been deprecated in favour of 'gnome:pango'.

See https://nvd.nist.gov/products/cpe/detail/19B77822-6C34-41C8-8160-367D56AD1569

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 6c5f1b6414)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-25 21:57:49 +02:00
Thomas Perale
bc41ad9a6c package/gnuplot: fix deprecated CPE
The CPE 'gnuplot_project:gnuplot' has been deprecated in favour of
'gnuplot:gnuplot'.

See the following:
  - https://nvd.nist.gov/products/cpe/detail/DB68C9F5-3330-4749-A6F5-61FF041037CC
  - https://nvd.nist.gov/vuln/detail/cve-2025-31178

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 0bbefd60f7)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-25 21:57:48 +02:00
Thomas Perale
94d38f42ee package/cpp-httplib: fix deprecated CPE
The CPE 'cpp_httplib_project:cpp-httplib' has been deprecated in favour
of 'yhirose:cpp-httplib'.

See https://nvd.nist.gov/products/cpe/detail/5D557BEA-8246-464C-AB90-EA9495A0732A

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit cf480bda61)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-25 21:57:47 +02:00
Thomas Perale
208a85d052 package/boinc: fix deprecated CPE
The CPE 'rom_walton:boinc' has been deprecated in favour of
'universityofcalifornia:boinc_client'.

See https://nvd.nist.gov/products/cpe/detail/DAC161C5-2154-44BF-916A-EACB524E8B8F

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 143bb15d6e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-25 21:57:45 +02:00
Thomas Perale
263cb00f11 package/asterisk: fix deprecated CPE ID
The CPE 'asterisk:open_source' has been deprecated in favour of
'sangoma:asterisk'.

See the following for more information:
 - https://nvd.nist.gov/products/cpe/detail/7FC01D7D-5AE9-42A8-B31E-A99E745E5BE5
 - https://github.com/asterisk/asterisk/security
 - https://nvd.nist.gov/vuln/detail/CVE-2024-42491

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 505cd0d367)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-25 21:57:44 +02:00
James Hilliard
eb0fc97fb8 utils/scanpypi: remove python six module
We dropped support for python2 a while back in [1], as such we
can remove the python six module which was only needed for
backwards comaptibility with python2.

[1] 2743ce00ca

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
[Julien: add commit ref removing python2 support]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 53eb75ef53)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-25 21:57:43 +02:00
James Hilliard
2004334a6b package/python-pytz: bump to version 2025.2
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 9a54553b85)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-25 21:57:42 +02:00
Fiona Klute (WIWA)
2c8fa9497d package/python-trove-classifiers: bump to version 2025.9.11.17
package/python-cffi 2.0.0 (bumped in commit
07903d2b27) fails to build due to an
unknown trove-classifier:

* Getting build dependencies for wheel...
configuration error: `project.classifiers[8]` must be trove-classifier
DESCRIPTION:
    `PyPI classifier <https://pypi.org/classifiers/>`_.

GIVEN VALUE:
    "Programming Language :: Python :: Free Threading :: 2 - Beta"

OFFENDING RULE: 'format'

DEFINITION:
    {
        "type": "string",
        "format": "trove-classifier"
    }

For more details about `format` see
https://validate-pyproject.readthedocs.io/en/latest/api/validate_pyproject.formats.html

The list of trove classifiers Setuptools checks against is provided by
package/python-trove-classifiers. Upstream has added the classifier as
of version 2025.5.8.15 [1], as well as a bunch of others [2], so
update to fix the problem.

[1] 331838aaea
[2] https://github.com/pypa/trove-classifiers/compare/2025.1.15.22...2025.9.11.17

Fixes:
- 07903d2b27
- https://autobuild.buildroot.org/results/45b57a919182ae3f9ea0db9b0fa430a72e1e3cdf/

Signed-off-by: Fiona Klute (WIWA) <fiona.klute@gmx.de>
[Julien: add link to autobuilder failure]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 44e0ba2bd2)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-25 21:57:41 +02:00
James Hilliard
6bf95861c8 package/python-certifi: bump to version 2025.8.3
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit b3809dfaf3)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-25 21:57:40 +02:00
Julien Olivain
55db5c86ac boot/boot-wrapper-aarch64: add hash file
Since boot-wrapper-aarch64 introduction in commit [1]
"boot-wrapper-aarch64: new package", the package never received a hash
file. This commit adds it, including the source archive and license
hashes.

[1] 7689b72e00

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 4b14018a38)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-25 21:57:38 +02:00
Julien Olivain
8a48958232 boot/boot-wrapper-aarch64/Config.in: switch homepage URL to https
Buildroot commit [1] ("package: replace git:// URLs with https://
URLs where possible") switched _SITE URL from git to https, but did
not updated the package homepage in Config.in.

This commit updates it to match the package _SITE URL.

[1] 6626bf7c5f

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit afff65c340)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-25 21:57:37 +02:00
Thomas Devoogdt
210f2b18c8 package/webkitgtk: security bump to version 2.48.6
Fixes a number of crashes. Release notes:

 - https://webkitgtk.org/2025/07/30/webkitgtk2.48.4-released.html
 - https://webkitgtk.org/2025/08/01/webkitgtk2.48.5-released.html
 - https://webkitgtk.org/2025/09/03/webkitgtk2.48.6-released.html

And brings some security fixes. Security advisory:

 - https://webkitgtk.org/security/WSA-2025-0005.html

Signed-off-by: Thomas Devoogdt <thomas@devoogdt.com>
Acked-By: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit dd68f4edd2)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-25 21:57:36 +02:00
Peter Korsgaard
8273db5669 package/cjson: security bump to version 1.7.19
Fixes the following security issue:

CVE-2025-57052: cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via
the decode_array_index_from_pointer function in cJSON_Utils.c, allowing
remote attackers to bypass array bounds checking and access restricted data
via malformed JSON pointer strings containing alphanumeric characters

https://nvd.nist.gov/vuln/detail/CVE-2025-57052
https://x-0r.com/posts/cJSON-Array-Index-Parsing-Vulnerability
74e1ff4994
https://github.com/DaveGamble/cJSON/releases/tag/v1.7.19

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit a93602c00b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-25 21:57:35 +02:00
Thomas Perale
ca3e495b29 package/cjson: update deprecated CPE
The CPE 'cpe:2.3:a:cjson_project:cjson:0.0.0:*:*:*:*:*:*:*' has been
deprecated in favour of 'cpe:2.3:a:davegamble:cjson:0.0.0:*:*:*:*:*:*:*''

See https://nvd.nist.gov/products/cpe/detail/70BC45DA-D915-4A1D-96AF-84A6CECEE148

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d6c05d06d0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-25 21:57:34 +02:00
Titouan Christophe
a4f6e6c5f0 package/python-flask-cors: fix PKG_SITE
python-flask-cors was security bumped in commit 04cd135b26 [1], however this
commit did not update the _SITE url; which changes with each new release on
pypi. Therefore, downloading python-flask-cors would always fail.

Fixes:
https://autobuild.buildroot.org/results/eeadcb2e416cddaa5d059b31ea5dcc9f766a3cff

[1] 04cd135b26

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
[Julien: add "Fixes" in commit log, from Yegor Yefremov comment]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit cbc3cb2c8d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-25 21:57:33 +02:00
Titouan Christophe
e3527395d2 {linux, linux-headers}: bump 6.12.x, 6.6.x, 6.1.x series
Update the latest kernel releases to:
 - 6.12.47 -> 6.12.48
 - 6.6.106 -> 6.6.107
 - 6.1.152 -> 6.1.153

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-09-25 21:57:32 +02:00
Titouan Christophe
097e117a7d package/samba4: bump to v4.21.8
See the release notes
https://www.samba.org/samba/history/samba-4.21.8.html

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2025-09-19 14:55:10 +02:00
Thomas Petazzoni
47a77649a7 package/policycoreutils: fix build with musl due to getpass()
policycoreutils uses getpass(), which with musl is only defined with
some feature macro defined, such as _GNU_SOURCE. So let's pick-up an
upstream fix to address this issue.

There are no autobuilder failures, the issue was most likely hidden by
other failures with musl affecting the SELinux stack.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit fc472cc8c7)
[thomas: fix patch]
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-18 11:39:48 +02:00
Thomas Petazzoni
67a5d87a90 package/libsemanage: fix build issue due to basename()
The build of libsemanage on musl configurations fails with:

direct_api.c: In function 'semanage_direct_install_file':
direct_api.c:1746:20: error: implicit declaration of function 'basename' [-Wimplicit-function-declaration]
 1746 |         filename = basename(path);
      |                    ^~~~~~~~

This fails to build even with a GCC 14.x toolchain, even with
libsemanage 3.7, which is the version we have in our LTS branch.

Let's backport an upstream patch fixing this issue.

Fixes:

  https://autobuild.buildroot.net/results/913852e35c925888ced37e15be3731b9d3963019/

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 79031b79c2)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-18 10:49:08 +02:00
Thomas Petazzoni
075b51ec40 package/libselinux: fix build issues caused by 3.8.1 bump
Since the bump to version 3.8.1 in commit
1ae3ad4e87, libselinux fails to build
with at least

- Musl configurations
- RISC-V 32-bit configurations
- OpenRISC configurations

These build failures are due to additional checks on the size of some
data structures:

matchpathcon.c:270:47: error: '__ino_t' undeclared here (not in a function); did you mean 'ino_t'?
  270 | static_assert(sizeof(unsigned long) == sizeof(__ino_t), "inode size mismatch");
      |                                               ^~~~~~~
      |                                               ino_t
matchpathcon.c:270:15: error: expression in static assertion is not an integer
  270 | static_assert(sizeof(unsigned long) == sizeof(__ino_t), "inode size mismatch");
      |               ^~~~~~

These issues have been fixed in follow-up upstream commits, which we
backport.

Fixes:

  https://autobuild.buildroot.net/results/00a1ab30cc6b7af503aa96384ba4c4444c217401/ (musl)
  https://autobuild.buildroot.net/results/c8321be687201937bd5eb48b31dfabac12f4e9ea/ (glibc or1k)
  https://autobuild.buildroot.net/results/7b94f44282582d5994f40a741cc0c38bd68b53bd/ (risc-v 32-bit)

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d5aab5289c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-18 10:48:49 +02:00
Romain Naour
ea4f8ce14e package/luvi: bump to version 2.15.0
Luvi 2.14.0 fails to build with GCC 14.x for several reasons due to
too old lua-openssl 0.8.2-0 submodule:

TestLuvi/build/luvi-2.14.0/deps/lua-openssl/src/ocsp.c: In function 'openssl_ocsp_request_read':
TestLuvi/build/luvi-2.14.0/deps/lua-openssl/src/ocsp.c:124:29: error: passing argument 1 of 'PEM_ASN1_read_bio' from incompatible pointer type [-Wincompatible-pointer-types]
  124 |   OCSP_REQUEST *req = pem ? PEM_read_bio_OCSP_REQUEST(bio, NULL, NULL)
      |                             ^~~~~~~~~~~~~~~~~~~~~~~~~
      |                             |
      |                             char * (*)()

Fixed in lua-openssl by [1].

TestLuvi/build/luvi-2.14.0/deps/lua-openssl/src/x509.c: In function 'openssl_push_general_name':
TestLuvi/build/luvi-2.14.0/deps/lua-openssl/src/x509.c:377:45: error: passing argument 2 of 'openssl_push_asn1type' from incompatible pointer type [-Wincompatible-pointer-types]
  377 |     openssl_push_asn1type(L, general_name->d.x400Address);
      |                              ~~~~~~~~~~~~~~~^~~~~~~~~~~~
      |                                             |
      |                                             ASN1_STRING * {aka struct asn1_string_st *}

Fixed in lua-openssl by [2].

TestLuvi/build/luvi-2.14.0/deps/lua-openssl/src/openssl.c: In function 'luaclose_openssl':
TestLuvi/build/luvi-2.14.0/deps/lua-openssl/src/stdatomic.h:387:9: error: implicit declaration of function '__c11_atomic_fetch_sub'; did you mean '__atomic_fetch_sub'? [-Wimplicit-function-declaration]
  387 |         __c11_atomic_fetch_sub(object, operand, order)

Fixed in lua-openssl by [3].

Instead of fixing one by one each issues, update to the latest release
that include lua-openssl 0.9.0-0. Luvi v2.15.0 still have some GCC 14.x
issues, backport two additional patches.

Download luvi sources using git method since the release archive
no longer include the release version in its name [4].

Luvi switched to PCRE2 [5], update the optional dependency.

Update TestLuvi to select PCR2 package.

Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/11271124430 (TestLuvi)

[1] bfeedbe8c0
[2] e5b5420cc5
[3] cfcaa16d1a
[4] https://github.com/luvit/luvi/releases/download/v2.15.0/luvi-source.tar.gz
[5] https://github.com/luvit/luvi/releases/tag/v2.15.0

Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 00317f0aff)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-18 10:48:20 +02:00
Peter Korsgaard
66ccfef7c0 package/pcre2: security bump to version 10.46
Fixes the following security issue:

- CVE-2025-58050: PCRE2: heap-buffer-overflow read in match_ref due to
  missing boundary restoration in SCS

Compared to 10.45, this release has only a minimal code change to prevent a
read-past-the-end memory error, of arbitrary length.  An attacker-controlled
regex pattern is required, and it cannot be triggered by providing crafted
subject (match) text.  The (*ACCEPT) and (*scs:) pattern features must be
used together.

Release 10.44 and earlier are not affected.

https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-c2gv-xgf5-5cc2
https://www.cve.org/CVERecord?id=CVE-2025-58050

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
[Julien: add link to CVE in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 9fd06f212a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-18 10:43:33 +02:00
Romain Naour
4ebd192104 package/mariadb: workaround cmake < 3.30 check TRY_RUN issue
The last mariadb version bump [1] added -DHAVE_SYSTEM_LIBFMT_EXITCODE=0
to workaround cross-compiling issue during libfmt cmake check.
But it actually requies at least cmake >= 3.30 to work.
Indeed, our docker image used by Gitlab-CI uses cmake 3.25.1 and
segfault while testing for libfmt.

  -- Performing Test HAVE_SYSTEM_LIBFMT
  /bin/bash: line 1: 163369 Segmentation fault

  $ cmake --version
  cmake version 3.25.1

Using the same TestPerlDBDmysql configuration locally with
cmake 3.30.8 installed build fine.

Looking at cmake cmTryRunCommand.cxx history from 3.30.x show that
several fixes about cross-compiling isses were applied to cmake 3.26.x
[2] probably solving the issue. Requires BR2_HOST_CMAKE_AT_LEAST_3_30
for now, since only cmake 3.30.8 installed locally was tested.

Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/11271124486 (TestPerlDBDmysql)
https://gitlab.com/buildroot.org/buildroot/-/jobs/11271124439 (TestMariaDB)

[1] 6cd8f95346 ("package/mariadb: bump version to 10.11.11")
[2] https://gitlab.kitware.com/cmake/cmake/-/commits/v3.30.9/Source/cmTryRunCommand.cxx?ref_type=tags

Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit de9c0f971c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-18 10:42:28 +02:00