Commit Graph

77114 Commits

Author SHA1 Message Date
Fred Lefranc
06a92ffdcc package/haproxy: bump version to 2.6.22
Changelog: http://www.haproxy.org/download/2.6/src/CHANGELOG

Signed-off-by: Fred Lefranc <fred.lefranc+evs@gmail.com>
[thomas: fixed the '.hash' file from patch to apply]
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-25 23:02:36 +02:00
Bernd Kuhls
9eb5e71313 {linux, linux-headers}: bump 6.{6, 12}.x series
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 7a1d7189a0)
[thomas: dropped 6.15]
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-24 21:01:42 +02:00
Giulio Benetti
54a1ed543f package/libblockdev: security bump to version 3.3.1
This version fixes CVE-2025-6019, see:
https://github.com/storaged-project/libblockdev/blob/3.3.1/NEWS.rst

Fixes:
https://www.cve.org/CVERecord?id=CVE-2025-6019

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
[Julien: add link to CVE]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 0233c854b1)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-24 21:00:19 +02:00
Romain Naour
3045f77545 package/squashfs: update URL to source archive after Github changes
The squashfs 4.6.1 archive hash has been changed suddenly two weeks
ago by Github without any intended changes from the squashfs maintainer
[1].

The orginal squashfs 4.6.1 archive has been manually uploaded again.

Update the URL to download the archive that match the expected hash.

Since we don't use the github download helper anymore, the squashfs
archive name is changed from squashfs-4.6.1.tar.gz to
squashfs-tools-4.6.1.tar.gz.

Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/10355448207
(and many more...)

See:
[1] https://github.com/plougher/squashfs-tools/issues/313

Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e374ae03b5)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-24 21:00:13 +02:00
Bernd Kuhls
df5f63f7a0 package/clamav: security bump version to 1.0.9
Fixes CVE-2025-20260:
"The code flaw was present prior to version 1.0.0, but a change in
 version 1.0.0 that enables larger allocations based on untrusted data
 made it possible to trigger this bug."
https://blog.clamav.net/2025/06/clamav-143-and-109-security-patch.html

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 09f6aa642d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-24 21:00:08 +02:00
Fiona Klute (WIWA)
3b609f1b0c package/libndp: fix build with GCC 14 and musl
Patch has been pending upstream for a while [1], Alpine has merged an
older version that includes some whitespace damage but is functionally
equivalent.

[1] https://github.com/jpirko/libndp/pull/29

Signed-off-by: Fiona Klute (WIWA) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 0c2aa35fbe)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-24 21:00:02 +02:00
Gwenhael Goavec-Merou
6fb63beb84 package/python-remi: bump to master commit and fixes build failure
REMI hasn't received new release since July 2022 and is currently broken
with error:

Traceback (most recent call last):
  File "<string>", line 26, in <module>
  File "/workdir/instance-0/output-1/host/lib/python3.13/site-packages/setuptools/__init__.py", line 116, in setup
    _install_setup_requires(attrs)
    ~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^
  File "/workdir/instance-0/output-1/host/lib/python3.13/site-packages/setuptools/__init__.py", line 89, in _install_setup_requires
    _fetch_build_eggs(dist)
    ~~~~~~~~~~~~~~~~~^^^^^^
  File "/workdir/instance-0/output-1/host/lib/python3.13/site-packages/setuptools/__init__.py", line 94, in _fetch_build_eggs
    dist.fetch_build_eggs(dist.setup_requires)
    ~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^
  File "/workdir/instance-0/output-1/host/lib/python3.13/site-packages/setuptools/build_meta.py", line 80, in fetch_build_eggs
    raise SetupRequirementsError(specifier_list)
setuptools.build_meta.SetupRequirementsError: ['setuptools_scm']

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/workdir/instance-0/output-1/host/lib/python3.13/site-packages/pyproject_hooks/_in_process/_in_process.py", line 389, in <module>
    main()
    ~~~~^^
  File "/workdir/instance-0/output-1/host/lib/python3.13/site-packages/pyproject_hooks/_in_process/_in_process.py", line 373, in main
    json_out["return_val"] = hook(**hook_input["kwargs"])
                             ~~~~^^^^^^^^^^^^^^^^^^^^^^^^
  File "/workdir/instance-0/output-1/host/lib/python3.13/site-packages/pyproject_hooks/_in_process/_in_process.py", line 143, in get_requires_for_build_wheel
    return hook(config_settings)
  File "/workdir/instance-0/output-1/host/lib/python3.13/site-packages/setuptools/build_meta.py", line 331, in get_requires_for_build_wheel
    return self._get_build_requires(config_settings, requirements=[])
           ~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/workdir/instance-0/output-1/host/lib/python3.13/site-packages/setuptools/build_meta.py", line 301, in _get_build_requires
    self.run_setup()
    ~~~~~~~~~~~~~~^^
  File "/workdir/instance-0/output-1/host/lib/python3.13/site-packages/setuptools/build_meta.py", line 512, in run_setup
    super().run_setup(setup_script=setup_script)
    ~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/workdir/instance-0/output-1/host/lib/python3.13/site-packages/setuptools/build_meta.py", line 317, in run_setup
    exec(code, locals())
    ~~~~^^^^^^^^^^^^^^^^
  File "<string>", line 31, in <module>
  File "/workdir/instance-0/output-1/host/lib/python3.13/site-packages/setuptools/__init__.py", line 117, in setup
    return distutils.core.setup(**attrs)
           ~~~~~~~~~~~~~~~~~~~~^^^^^^^^^
  File "/workdir/instance-0/output-1/host/lib/python3.13/site-packages/setuptools/_distutils/core.py", line 148, in setup
    _setup_distribution = dist = klass(attrs)
                                 ~~~~~^^^^^^^
  File "/workdir/instance-0/output-1/host/lib/python3.13/site-packages/setuptools/dist.py", line 323, in __init__
    _Distribution.__init__(self, dist_attrs)
    ~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^
  File "/workdir/instance-0/output-1/host/lib/python3.13/site-packages/setuptools/_distutils/dist.py", line 309, in __init__
    self.finalize_options()
    ~~~~~~~~~~~~~~~~~~~~~^^
  File "/workdir/instance-0/output-1/host/lib/python3.13/site-packages/setuptools/dist.py", line 786, in finalize_options
    ep(self)
    ~~^^^^^^
  File "/workdir/instance-0/output-1/host/lib/python3.13/site-packages/setuptools/dist.py", line 806, in _finalize_setup_keywords
    ep.load()(self, ep.name, value)
    ~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^
  File "/workdir/instance-0/output-1/host/lib/python3.13/site-packages/setuptools_scm/_integration/setuptools.py", line 82, in version_keyword
    assert isinstance(value, dict), "version_keyword expects a dict or True"
           ~~~~~~~~~~^^^^^^^^^^^^^
AssertionError: version_keyword expects a dict or True

ERROR Backend subprocess exited when trying to invoke get_requires_for_build_wheel
make: *** [package/pkg-generic.mk:273: /workdir/instance-0/output-1/build/python-remi-2022.7.27/.stamp_built] Error 1
make: Leaving directory '/workdir/instance-0/buildroot'

Since last release code has been corrected and now build end
successfully.

Another issue with remi is related to python CGI library no more available with
python 3.13. This patch also updates Config.in to add a select BR2_PACKAGE_PYTHON_LEGACY_CGI

This commit also updates the LICENSE file hash, because line ending
changed from "CR-LF" (Windows) in old release archive to "LF" (Unix)
in the github download. Apart from that, the content is the same.

Fixes:
- https://autobuild.buildroot.org/results/f0409533ebdc31e522f2ee2ea8a5acc11dbc7430/
- https://autobuild.buildroot.org/results/a16cf5105d4b726b5d4136a2d8f82abcfdc0faba/
- https://autobuild.buildroot.org/results/e7ac28e20ad92863d337e96c225463346ee6c690/

Signed-off-by: Gwenhael Goavec-Merou <gwenhael.goavec-merou@trabucayre.com>
[Julien:
 - use "git describe --abbrev=40" format in _VERSION
 - fix LICENSE hash
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 14ce0d2e6e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-24 20:59:51 +02:00
Marcus Hoffmann
ac4c28953a package/ca-certificates: bump to 20250419
Changelog: https://metadata.ftp-master.debian.org/changelogs//main/c/ca-certificates/ca-certificates_20250419_changelog

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 4a085462e4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-24 20:59:45 +02:00
Bernd Kuhls
a3b39cf383 package/python-glslang: fix host-python3 dependency
python-glslang is a host-only package and the host-python3 dependency
was wrongly added as target dependency with buildroot commit
f9fe0cf8f6.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 27a38cbcad)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-24 20:59:39 +02:00
Titouan Christophe
5c96f8d7f8 package/python3: security bump to v3.12.11
This fixes the following CVEs affecting tarfile extraction filters:

- CVE-2024-12718:
    Bypass extraction filter to modify file metadata outside
    extraction directory

- CVE-2025-4138:
    Bypassing extraction filter to create symlinks to arbitrary targets
    outside extraction directory

- CVE-2025-4330:
    Extraction filter bypass for linking outside extraction directory

- CVE-2025-4435:
    Tarfile extracts filtered members when errorlevel=0

- CVE-2025-4517:
    Arbitrary writes via tarfile realpath overflow

See https://www.python.org/downloads/release/python-31211/

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-24 20:52:51 +02:00
Arnout Vandecappelle
00d5d387f5 Makefile: update for 2025.02.4
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2025.02.4
2025-06-23 18:32:11 +02:00
Titouan Christophe
a7eb8e598d CHANGES: update for 2025.02.4
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2025-06-23 18:30:47 +02:00
Yuce Kurum
a9fd428c61 package/jq: security patch for CVE-2025-48060
Security patch have been fetched from the Nixpkgs [1].

Fixes the following CVE:
- CVE-2025-48060: jq is a command-line JSON processor. In versions up to
 and including 1.7.1, a heap-buffer-overflow is present in function
  in the jq_fuzz_execute harness from oss-fuzz. This
 crash happens on file jv.c, line 1456 . As of
 time of publication, no patched versions are available.

For more information, see:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-48060

[1] df21c79bfb/pkgs/by-name/jq/jq/0005-Fix-heap-buffer-overflow-when-formatting-an-empty-st.patch

Signed-off-by: Yuce Kurum <yuce.kurum@mind.be>
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-18 14:40:32 +02:00
Bernd Kuhls
06c5664b18 package/samba4: security bump version to 4.21.6
Release notes:
https://www.samba.org/samba/history/samba-4.21.5.html
https://www.samba.org/samba/history/samba-4.21.6.html

Version 4.21.6 fixes CVE-2025-0620:
https://www.samba.org/samba/security/CVE-2025-0620.html

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit cae9a45e55)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-18 11:10:30 +02:00
Marcus Hoffmann
109c9bcd24 package/python-requests: update project homepage
http://www.python-requests.org/ is dead, the project lives on
https://requests.readthedocs.io/ now.

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 15996bc4ff)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-18 11:10:24 +02:00
Marcus Hoffmann
c2de84a325 package/python-requests: security bump to 2.32.4
Fixes: CVE-2024-47081
  Fixed an issue where a maliciously crafted URL and
  trusted environment will retrieve credentials for
  the wrong hostname/machine from a netrc file.

Release notes: https://github.com/psf/requests/releases/tag/v2.32.4

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit aefdca1e5c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-18 11:10:08 +02:00
Bernd Kuhls
ef10c07591 package/php: bump version to 8.3.22
Changelog: https://www.php.net/ChangeLog-8.php#8.3.22

Release notes:
https://news-web.php.net/php.announce/460

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 1b4b429e89)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-18 11:09:47 +02:00
Bernd Kuhls
47ec015ea1 package/libebur128: remove package
libebur128 was added to buildroot in July 2016 with commit
a32d29cd84 to provide an external
dependency for ffmpeg.

ffmpeg removed this external dependency and switched to an internal
version in November 2016 with upstream commit
http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=005d058f4230f3207ebcf1131df7426d4f57392f
which was first included in ffmpeg version 3.3.

Buildroot bumped ffmpeg to version 3.3 in April 2017 with commit
21d93a1351 and forgot to remove the
dependency to libebur128.

This went unnoticed until libebur128 fails to build with cmake 4.x.
Upstream saw its last commit four years ago. Instead of fixing an
unused package we removed it from buildroot.

Fixes:
https://autobuild.buildroot.org/results/e629bd151cc539f01b909e44d07e17451a29ba27/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 6586a2b165)
[thomas: backport Config.in.legacy to LTS branch]
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-18 11:08:42 +02:00
Bernd Kuhls
8d7db3a217 {linux, linux-headers}: bump 6.12.x series
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 3a00ac13d8)
[thomas: only 6.12 bump]
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-18 11:05:51 +02:00
Thomas Perale
a0b458582f package/python-django: security bump to 5.1.11
Fixes the following security issue:

- CVE-2025-48432: Internal HTTP response logging does not escape
  request.path, which allows remote attackers to potentially manipulate
  log output via crafted URLs. This may lead to log injection or forgery
  when logs are viewed in terminals or processed by external systems.

For more information, see:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-48432

For more details on the version bump, see the release notes:
 - https://docs.djangoproject.com/en/5.1/releases/5.1.11/

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-18 10:34:23 +02:00
Thomas Perale via buildroot
4b51570686 package/jq: security patch for CVE-2024-{23337, 53427}
Those security patches have been fetched from the debian patches for
this package version [1].

Fixes the following CVEs:

- CVE-2024-23337: an integer overflow arises when assigning value using
  an index of 2147483647, the signed integer limit. This causes a denial
  of service.

For more information, see:
  - https://nvd.nist.gov/vuln/detail/CVE-2024-23337
  - de21386681

- CVE-2024-53427: decNumberCopy in decNumber.c does not properly
  consider that NaN is interpreted as numeric, which has a resultant
  stack-based buffer overflow and out-of-bounds write, as demonstrated
  by use of --slurp with subtraction, such as a filter of .-. when the
  input has a certain form of digit string with NaN (e.g., "1 NaN123"
  immediately followed by many more digits).

For more information, see:
  - https://nvd.nist.gov/vuln/detail/CVE-2024-53427
  - a09a4dfd55

[1] https://udd.debian.org/patches.cgi?src=jq&version=1.7.1-6

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-12 22:18:41 +02:00
Thomas Perale via buildroot
430b2c3fb9 package/fluent-bit: build fix for toolchains w/o CXX
Since the package bump [1] the fluent-bit package started to fail
because of an update introduced in fluent-bit v3.2.7 (see [2]).

The following error appeared on the autobuilder in the LTS branch.

```
CMake Error at /home/buildroot/instance-0/output-1/host/share/cmake-3.31/Modules/CMakeTestCXXCompiler.cmake:73 (message):
  The C++ compiler

    "/bin/false"

  is not able to compile a simple test program.

  It fails with the following output:

    Change Dir: '/home/buildroot/instance-0/output-1/build/fluent-bit-3.2.10/CMakeFiles/CMakeScratch/TryCompile-u4rLgc'

    Run Build Command(s): /home/buildroot/instance-0/output-1/host/bin/ninja -v cmTC_71bbf
    [1/2] /bin/false    -o CMakeFiles/cmTC_71bbf.dir/testCXXCompiler.cxx.o -c /home/buildroot/instance-0/output-1/build/fluent-bit-3.2.10/CMakeFiles/CMakeScratch/TryCompile-u4rLgc/testCXXCompiler.cxx
    FAILED: CMakeFiles/cmTC_71bbf.dir/testCXXCompiler.cxx.o
    /bin/false    -o CMakeFiles/cmTC_71bbf.dir/testCXXCompiler.cxx.o -c /home/buildroot/instance-0/output-1/build/fluent-bit-3.2.10/CMakeFiles/CMakeScratch/TryCompile-u4rLgc/testCXXCompiler.cxx
    ninja: build stopped: subcommand failed.

  CMake will not be able to correctly generate this project.
Call Stack (most recent call first):
  lib/zstd-1.5.7/build/cmake/CMakeLists.txt:36 (project)
```

The commit [3] included two patches to fix the build error
for configs using toolchains without CXX.

Since the build error was already present on v3.2.10,
those patches actually fix the error for LTS version as well.
This patch pick them from the series to apply them on the LTS
branch.

[1] 8bc18fad29 package/fluent-bit: bump to 3.2.10
[2] 0ce59cecdc
[3] 8181727e23 package/fluent-bit: bump to 4.0.0

Fixes: https://autobuild.buildroot.org/results/4b0/4b0646e8fcc3f023ab0173ea8725f381e5055152/

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-12 22:18:03 +02:00
Peter Korsgaard
d4c080b56d package/libcurl: fix build w/ threads + c-ares
Fixes:
https://autobuild.buildroot.net/results/680b825b93989e6aef247593c198094a6ed916f7/

Since curl 8.14.0 with commit d364f1347f05 ("configure: catch asking for
double resolver without https-rr"), configure errors out when
--enabled-threaded-resolver is used together with --enable-ares (unless the
experimental HTTPS-RR support is enabled), so disable the threaded resolver
when c-ares is enabled.

d364f1347f

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Reviewed-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 0fce7a9623)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-12 22:11:29 +02:00
Peter Korsgaard
105442445d package/libcurl: drop _GNU_SOURCE workaround
This was needed for 8.14.0, but got fixed in 8.14.1 with:

https://github.com/curl/curl/issues/17512

So drop it again.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit e6567881e4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-12 22:11:24 +02:00
Kadambini Nema
fd8aa43dcb package/libcurl: security bump to version 8.14.1
Fixes the following security issues:
- CVE-2025-5025:
  No QUIC certificate pinning with wolfSSL.
  https://curl.se/docs/CVE-2025-5025.html

- CVE-2025-4947:
  QUIC certificate check skip with wolfSSL.
  https://curl.se/docs/CVE-2025-4947.html

- CVE-2025-5399:
  WebSocket endless loop
  https://curl.se/docs/CVE-2025-5399.html

Changelog:
https://curl.se/ch/8.14.0.html
https://curl.se/ch/8.14.1.html

Signed-off-by: Kadambini Nema <kadambini.nema@gmail.com>
[Peter: bump to 8.14.1 instead]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 1dfe081a19)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-12 22:11:18 +02:00
Kadambini Nema
ded7391ea6 package/libcurl: bump version to 8.13.0
Changelog:
https://curl.se/ch/8.13.0.html

Signed-off-by: Kadambini Nema <kadambini.nema@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit c8ba9da529)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-12 22:11:11 +02:00
Petr Vorel
ec1fe1110a package/iputils: bump version 20250605
Bugfix release:
https://github.com/iputils/iputils/releases/tag/20250605

Signed-off-by: Petr Vorel <petr.vorel@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 34611327b8)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-12 14:41:07 +02:00
Julien Olivain
86e01fe7cc package/dovecot: add missing mariadb dependencies for mysql support
Buildroot commit [1] removed mysql and replaced it by mariadb in all
packages, but did not propagated all dependencies.

This commit fixes the issue.

Fixes:

    WARNING: unmet direct dependencies detected for BR2_PACKAGE_MARIADB
      Depends on [n]: BR2_INSTALL_LIBSTDCPP [=y] && !BR2_STATIC_LIBS [=n] && BR2_USE_MMU [=y] && BR2_TOOLCHAIN_HAS_THREADS [=y] && (BR2_TOOLCHAIN_HAS_ATOMIC [=n] || BR2_TOOLCHAIN_HAS_SYNC_8 [=n]) && BR2_USE_WCHAR [=y]
      Selected by [y]:
      - BR2_PACKAGE_DOVECOT_MYSQL [=y] && BR2_PACKAGE_DOVECOT [=y] && BR2_INSTALL_LIBSTDCPP [=y] && BR2_TOOLCHAIN_HAS_THREADS [=y]

[1] 8708f3a23a

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 6967ed93b6)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-12 14:41:05 +02:00
Julien Olivain
776bbc3d1c package/gstreamer1/gst1-plugins-bad: webrtc needs sync_4
Commit [1] "package/gstreamer1/gst1-plugins-bad: bump version
to 1.24.11" added new requirements for webrtc which selects the
sctp plugin, but forgot to propagate its dependencies. The sctp
plugin depends on BR2_TOOLCHAIN_HAS_SYNC_4.

This commit fixes this issue.

Fixes:

    WARNING: unmet direct dependencies detected for BR2_PACKAGE_GST1_PLUGINS_BAD_PLUGIN_SCTP
      Depends on [n]: BR2_PACKAGE_GSTREAMER1 [=y] && BR2_PACKAGE_GST1_PLUGINS_BAD [=y] && BR2_TOOLCHAIN_HAS_SYNC_4 [=n]
      Selected by [y]:
      - BR2_PACKAGE_GST1_PLUGINS_BAD_PLUGIN_WEBRTC [=y] && BR2_PACKAGE_GSTREAMER1 [=y] && BR2_PACKAGE_GST1_PLUGINS_BAD [=y] && !BR2_STATIC_LIBS [=n]

[1] 90b3cfedf4

Cc: Thomas Bonnefille <thomas.bonnefille@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit e34a113b32)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-12 14:41:02 +02:00
Peter Seiderer
ff8c9c5897 Revert "package/lm-sensors: update LM_SENSORS_VERSION"
Revert back to the hyphen version schema (as actual returned by
https://release-monitoring.org, see [1], [2]).

Fixes pkg-stats output.

This reverts commit 521afeab9b.

[1] https://release-monitoring.org/projects/search/?pattern=lm-sensors
[2] https://release-monitoring.org/project/1831/

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 8b736d1bde)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-12 14:41:00 +02:00
Thomas Perale
a49c47fa19 package/ghostscript: fix build with host GCC 15
Fix the following autobuild error on configs with host GCC15.

```
/workdir/instance-0/output-1/host/bin/ccache /usr/bin/gcc   -O2 -DNDEBUG -Wall -Wstrict-prototypes -Wundef -Wmissing-declarations -Wmissing-prototypes -Wwrite-strings -fno-strict-aliasing -Werror=declaration-after-statement -fno-builtin -fno-common -Werror=return-type -Wno-unused-local-typedefs -DHAVE_STDINT_H=1 -DHAVE_DIRENT_H=1 -DHAVE_SYS_DIR_H=1 -DHAVE_SYS_TIME_H=1 -DHAVE_SYS_TIMES_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_LIBDL=1 -DGX_COLOR_INDEX_TYPE="unsigned long long" -D__USE_UNIX98=1 -DHAVE_SNPRINTF  -O2 -I/workdir/instance-0/output-1/host/include -L/workdir/instance-0/output-1/host/lib -Wl,-rpath,/workdir/instance-0/output-1/host/lib -DNOCONTRIB -DHAVE_RESTRICT=1 -DHAVE_LIMITS_H=1 -DHAVE_STRING_H=1 -fno-strict-aliasing -O2 -I/workdir/instance-0/output-1/host/include -L/workdir/instance-0/output-1/host/lib -Wl,-rpath,/workdir/instance-0/output-1/host/lib -DHAVE_POPEN_PROTO=1  -I./base -o ./obj/aux/genconf ./base/genconf.c   -lz
In file included from ./base/genconf.c:18:
./base/stdpre.h:348:13: error: 'bool' cannot be defined via 'typedef'
  348 | typedef int bool;
      |             ^~~~
./base/stdpre.h:348:13: note: 'bool' is a keyword with '-std=c23' onwards
./base/stdpre.h:348:1: warning: useless type name in empty declaration
  348 | typedef int bool;
      | ^~~~~~~
```

This is due to the change in the default C language version in GCC15.

The patch included is not exactly the same as the upstream one, it only
picks the part that fix the `bool` definition and dropped the declaration
type changes.

Fixes: https://autobuild.buildroot.org/results/9c6/9c6cbff256635c6ab4be4c5b7bf18f9d3c4b46681

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit fa45c47fcb)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-12 14:40:58 +02:00
Peter Korsgaard
78a9b41ded package/go: security bump to version 1.23.10
go1.23.9 (released 2025-05-06) includes fixes to the runtime and the linker.

go1.23.10 (released 2025-06-05) includes security fixes to the net/http and
os packages, as well as bug fixes to the linker.

Fixes the following security vulnerabilities:

- CVE-2025-4673: net/http: sensitive headers not cleared on cross-origin
  redirect

  Proxy-Authorization and Proxy-Authenticate headers persisted on
  cross-origin redirects potentially leaking sensitive information

- CVE-2025-0913: os: inconsistent handling of O_CREATE|O_EXCL on Unix and
  Windows

  os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and
  Windows systems when the target path was a dangling symlink.  On Unix
  systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks.
  On Windows, when the target path was a symlink to a nonexistent location,
  OpenFile would create a file in that location.

- CVE-2025-22874: crypto/x509: usage of ExtKeyUsageAny disables policy validation

  Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny
  unintentionally disabled policy validation.  This only affected
  certificate chains which contain policy graphs, which are rather uncommon.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 00f0fca15a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-12 14:40:56 +02:00
Thomas Perale
ed5585a03c package/yasm: fix build with host GCC 15
Fix the following autobuild error that started appearing with host GCC15
configs.

```
/usr/bin/gcc -DHAVE_CONFIG_H -I.   -I/workdir/instance-0/output-1/host/include  -O2 -I/workdir/instance-0/output-1/host/include  -c -o modules/arch/x86/x86arch.o modules/arch/x86/x86arch.c
In file included from modules/arch/x86/x86arch.h:30,
                 from modules/arch/x86/x86arch.c:31:
./libyasm/bitvect.h:86:32: error: cannot use keyword 'false' as enumeration constant
   86 |         typedef enum boolean { false = FALSE, true = TRUE } boolean;
      |                                ^~~~~
./libyasm/bitvect.h:86:32: note: 'false' is a keyword with '-std=c23' onwards
```

This is due to the change in the default C language version in GCC15.

Fixes: https://autobuild.buildroot.org/results/d1d/d1d9a6e73c2ec278941dd90c6b07cce01b372feb/

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit aa9ee17701)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-12 14:40:54 +02:00
Bernd Kuhls
4c69a6ab6c {linux, linux-headers}: bump 5.{4, 10, 15}.x / 6.{1, 6, 12}.x series
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 34b847933e)
[thomas: dropped 6.14 bump]
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-12 14:40:52 +02:00
Roy Kollen Svendsen
59a61a317a package/qt6/qt6tools: build without clang support
Fixes:
If external clang is available on the host system, the buildsystem tries
to use it. The result will be unpredictable. We can't use the version of
clang that is shipped with buildroot either, because it is too old. See:
https://code.qt.io/cgit/qt/qttools.git/tree/.cmake.conf?h=6.8.1. So we
disable clang support in qt6tools for now.

Signed-off-by: Roy Kollen Svendsen <roykollensvendsen@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit ac7f65d83e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-12 14:40:50 +02:00
Roy Kollen Svendsen
1caa8366b8 package/qt6/qt6base: remove unused hidden host option
The previous commit removed its only user. It was a blind option so no
legacy handling is needed.

Signed-off-by: Roy Kollen Svendsen <roykollensvendsen@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 1fad08d32f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-12 14:40:48 +02:00
Roy Kollen Svendsen
9b532fac08 package/qt6/qt6tools: avoid build failures
Since we don't need assistant, designer or linguist on target, and we
don't need assistant or designer on host, we unconditionally disable
these tools, to avoid build failures without inreasing the complexity of
the package.

Fixes target linguist build:
-- Could NOT find Qt6LinguistTools (missing: Qt6LinguistTools_DIR)
CMake Error at <...>/output/build/qt6base-6.8.1/cmake/QtToolHelpers.cmake:768 (message):
  Failed to find the host tool "Qt6::lconvert".  It is part of the
  Qt6LinguistTools package, but the package could not be found.  Make sure
  you have built and installed the host Linguist module, which will ensure
  the creation of the Qt6LinguistTools package.
Call Stack (most recent call first):
  <...>/output/build/qt6base-6.8.1/cmake/QtToolHelpers.cmake:83 (qt_internal_find_tool)
  src/linguist/lconvert/CMakeLists.txt:9 (qt_internal_add_tool)

The following defconfig triggers a target linguist build without
building the necessary lconvert host tool. See:
https://code.qt.io/cgit/qt/qttools.git/tree/src/linguist/CMakeLists.txt?h=6.8.1#n17

BR2_arm=y
BR2_cortex_a9=y
BR2_ARM_ENABLE_VFP=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_ARMV7_EABIHF_MUSL_STABLE=y
BR2_PACKAGE_QT6=y
BR2_PACKAGE_QT6BASE_GUI=y
BR2_PACKAGE_QT6BASE_PNG=y
BR2_PACKAGE_QT6BASE_WIDGETS=y
BR2_PACKAGE_QT6TOOLS=y

Fixes target designer build:
CMake Error at <...>/output/build/qt6base-6.8.1/cmake/QtPublicWalkLibsHelpers.cmake:267 (message):
  The Xml target is mentioned as a dependency for Designer, but not declared.
Call Stack (most recent call first):
  <...>/output/build/qt6base-6.8.1/cmake/QtPrlHelpers.cmake:8 (__qt_internal_walk_libs)
  <...>/output/build/qt6base-6.8.1/cmake/QtPrlHelpers.cmake:47 (qt_collect_libs)
  <...>/buildroot/output/build/qt6base-6.8.1/cmake/QtModuleHelpers.cmake:1027 (qt_generate_prl_file)
  <...>/buildroot/output/build/qt6base-6.8.1/cmake/QtScopeFinalizerHelpers.cmake:24:EVAL:1 (qt_finalize_module)
  src/designer/src/lib/CMakeLists.txt:DEFERRED

The following defconfig triggers a target designer build, without
selecting the necessary xml qt6base option. See:
https://code.qt.io/cgit/qt/qttools.git/tree/configure.cmake?h=6.8.1#n64
https://code.qt.io/cgit/qt/qttools.git/tree/src/designer/src/lib/CMakeLists.txt?h=6.8.1#n182

BR2_arm=y
BR2_cortex_a9=y
BR2_ARM_ENABLE_VFP=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_ARMV7_EABIHF_MUSL_STABLE=y
BR2_PACKAGE_QT6=y
BR2_PACKAGE_QT6BASE_GUI=y
BR2_PACKAGE_QT6BASE_PNG=y
BR2_PACKAGE_QT6BASE_WIDGETS=y
BR2_PACKAGE_QT6TOOLS=y

Fixes target assistant build:
CMake Error at <...>/output/build/qt6base-6.8.1/cmake/QtToolHelpers.cmake:768 (message):
  Failed to find the host tool "Qt6::qhelpgenerator".  It is part of the
  Qt6ToolsTools package, but the package did not contain the tool.  Make sure
  that the host module Tools was built with all features enabled (no
  explicitly disabled tools).
Call Stack (most recent call first):
  <...>/buildroot/output/build/qt6base-6.8.1/cmake/QtToolHelpers.cmake:83 (qt_internal_find_tool)
  src/assistant/qhelpgenerator/CMakeLists.txt:9 (qt_internal_add_tool)

The following defconfig triggers a target assistant build, without
building the necessary qhelpgenerator host tool. See:
https://code.qt.io/cgit/qt/qttools.git/tree/configure.cmake?h=6.8.1#n45
https://code.qt.io/cgit/qt/qttools.git/tree/src/assistant/CMakeLists.txt?h=6.8.1#n4
https://code.qt.io/cgit/qt/qttools.git/tree/src/assistant/CMakeLists.txt?h=6.8.1#n21

BR2_arm=y
BR2_cortex_a9=y
BR2_ARM_ENABLE_VFP=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_ARMV7_EABIHF_MUSL_STABLE=y
BR2_PACKAGE_QT6=y
BR2_PACKAGE_QT6BASE_GUI=y
BR2_PACKAGE_QT6BASE_PNG=y
BR2_PACKAGE_QT6BASE_PRINTSUPPORT=y
BR2_PACKAGE_QT6BASE_SQL=y
BR2_PACKAGE_QT6BASE_SQLITE=y
BR2_PACKAGE_QT6BASE_WIDGETS=y
BR2_PACKAGE_QT6TOOLS=y

Signed-off-by: Roy Kollen Svendsen <roykollensvendsen@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit bd255e9e9c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-12 14:40:46 +02:00
Daniel Lang
e15bf2dcac package/ninja: ignore CVE-2021-4336
CVE is filed against a different project.

Signed-off-by: Daniel Lang <dalang@gmx.at>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit f1b759d34a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-12 14:40:44 +02:00
Peter Seiderer
1a93dc61f1 package/mongoose: fix openssl/mbedtls support
Since version bump to 7.12 (upstream commit [1]) the openssl/mbedtls support
defines changed from MG_ENABLE_OPENSSL/MG_ENABLE_MBEDTLS to
MG_TLS=MG_TLS_OPENSSL and MG_TLS=MG_TLS_MBED.

[1] 0613cc62f4

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 77d6929804)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-12 14:40:42 +02:00
Daniel Lang
7cf3df139e package/exim: drop stale CVE-2022-3559
The CVE database was updated and includes the additional "up to
(including) 4.97" version information.

Signed-off-by: Daniel Lang <dalang@gmx.at>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit e5865fec7e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-12 14:40:40 +02:00
Petr Vorel
bc90d131d6 package/iputils: security bump version to 20250602
https://github.com/iputils/iputils/releases/tag/20250602

Security release, fixes CVE-2025-47268 and CVE-2025-48964.

https://www.cve.org/CVERecord?id=CVE-2025-47268
https://www.cve.org/CVERecord?id=CVE-2025-48964

Signed-off-by: Petr Vorel <petr.vorel@gmail.com>
[Julien:
 - add "security" mention in commit log title
 - add link to CVEs
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit fe4533fd0d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-12 14:40:38 +02:00
Julien Olivain
bf54b97d5e support/testing: add tree runtime test
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 9d3b9d2220)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-12 14:40:36 +02:00
Stephan Henningsen
77eda2778d package/busybox: fix path for crond binary in S50crond during stop
Signed-off-by: Stephan Henningsen <stephan+buildroot@asklandd.dk>
Signed-off-by: Stephan Henningsen <stephan@asklandd.dk>
Reviewed-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 4ee0195241)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-12 14:40:34 +02:00
Alex Bennée
190426a830 testing: drop unneeded vga/vnc stanzas from QEMU invocation
The aarch64 virt platform doesn't have any default VGA devices so we
don't need to configure them here.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit b877b8379f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-12 14:40:32 +02:00
Arnout Vandecappelle
cd567301de package/qt5/qt5webengine: fix thumb detection logic
Add a patch that removes part of the logic that attempts to detect if
thumb is supported. This logic simply doesn't work at all in the
Buildroot context. In fact, thumb is supported on all 32-bit ARM on
which we can build qt5webengine.

Fixes:
WARNING: Thumb instruction set is required to build ffmpeg for QtWebEngine.
[...]
FAILED: obj/third_party/ffmpeg/ffmpeg_internal/vp8.o
[...] -c ../../3rdparty/chromium/third_party/ffmpeg/libavcodec/vp8.c -o obj/third_party/ffmpeg/ffmpeg_internal/vp8.o
{standard input}: Assembler messages:
{standard input}:1119: Error: bad instruction `ldrhcs r0,[ip],#2'
{standard input}:1156: Error: bad instruction `ldrhcs r9,[ip],#2'
{standard input}:1190: Error: bad instruction `ldrhcs lr,[ip],#2'
{standard input}:1253: Error: bad instruction `ldrhcs r9,[r7],#2'
[...]

Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
Cc: Gaël PORTAY <gael.portay@rtone.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 2b2120dc4a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-12 14:40:30 +02:00
Arnout Vandecappelle
da8b43bc92 package/qt5/qt5webengine-chromium: fix build with host GCC 15
Ideally we should update our version of qt5webengine-chromium first,
we're more than 600 commits behind on the stable branch from KDE.
However, this is a quick fix solution that allows us to build the
current state in Fedora 42.

Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit c9ae932c94)
[thomas: rename patch from 0012-.. to 0011-..]
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-12 14:40:28 +02:00
Arnout Vandecappelle
345f56ebe0 package/qt5/qt5declarative: fix build with GCC 15
Add a patch that adds missing #include statements, which becomes an
error in GCC 15.

Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 1495863b98)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-12 14:40:26 +02:00
Julien Olivain
9a67997454 support/testing: test_timezone: fix test by setting a fixed time
Since Buildroot commit [1], the runtime test emulator infra is setting
the emulated system date to the host date.

While this is desired in general, this behaviour is introducing a
variability in the test execution. Depending if the test is executed
during winter or summer time, the output of the command "date +%Z"
will produce a different output.

This commit fixes the issue by setting a fixed date and time on the
emulated system. The date is fixed to Unix Epoch plus one hour. This
is because Linux cannot set the system date to a value less than the
system uptime. So we cannot set the time back to Unix Epoch with the
command "date -s @0" (this would result to a EINVAL Invalid argument).

Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/9922589073
https://gitlab.com/buildroot.org/buildroot/-/jobs/9922589081

[1] cf8641b73e

Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 0839545a9b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-12 14:40:23 +02:00
Peter Korsgaard
33e6f2e395 package/libcamera: correct build directory for IPA stripping
Commit 4e95062f8 ("package/pkg-meson: use buildroot-build for build
directory") changed the build directory for meson packages to
'buildroot-build', so update the find invocation to match.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit c9355a3869)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-12 14:40:21 +02:00
Heiko Thiery
dd9c9b4058 package/kmsxx: fix meson build directory for extra tools
Commit 4e95062f8 ("package/pkg-meson: use buildroot-build for build directory")
changed the build directory for meson packages to 'buildroot-build'.
Thus accessing the build directory for installing the extra utils needs
to be adopted to this directory. Otherwise the install will fail when
BR2_PACKAGE_KMSXX_INSTALL_TESTS is enabled.

Signed-off-by: Heiko Thiery <heiko.thiery@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 55979f081d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-12 14:40:19 +02:00