For change log, see:
https://logging.apache.org/log4cxx/1.7.0/changelog.html
This fixes the following vulnerability:
- CVE-2026-40023:
Apache Log4cxx's XMLLayout
https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayout.html,
in versions before 1.7.0, fails to sanitize characters forbidden
by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets
in log messages, NDC, and MDC property keys and values, producing
invalid XML output. Conforming XML parsers must reject such
documents with a fatal error, which may cause downstream log
processing systems to drop or fail to index affected records.
An attacker who can influence logged data can exploit this
to suppress individual log records, impairing audit trails and
detection of malicious activity. Users are advised to upgrade to
Apache Log4cxx 1.7.0, which fixes this issue.
https://www.cve.org/CVERecord?id=CVE-2026-40023
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
[Julien: add link to change log in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
See NEWS:
https://github.com/magic-wormhole/magic-wormhole-transit-relay/blob/0.5.0/NEWS.md
The upstream source archive name changed (dash '-' changed to
underscore '_'). This commit updates _SOURCE to reflect that change.
This commit also updates _SITE to use a stable URL which will redirect
to the package archive, to reduce future maintenance.
This package has been broken at runtime since Buildroot commit [1]
"package/python-setuptools: bump to version 82.0.0", which removed
the python module 'pkg_resources' which was deprecated. This new
version removes those usage and fixes this issue.
Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/13904071794
Note: this commit fixes only the runtime invocation of transitrelay,
the complete fix for the test_python_magic_wormhole runtime test
also requires the update of python-magic-wormhole-mailbox-server.
[1] 51365ff063
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
See NEWS:
https://github.com/magic-wormhole/magic-wormhole-mailbox-server/blob/0.6.0/NEWS.md
The upstream source archive name changed (dash '-' changed to
underscore '_'). This commit updates _SOURCE to reflect that change.
This commit also updates _SITE to use a stable URL which will redirect
to the package archive, to reduce future maintenance.
This package has been broken at runtime since Buildroot commit [1]
"package/python-setuptools: bump to version 82.0.0", which removed
the python module 'pkg_resources' which was deprecated. This new
version removes those usage and fixes this issue. Setupuptools is still
erroneously listed as a dependency in the upstream setup.py[2] but is not
actually used anymore at runtime.
Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/13904071794
Note: this commit fixes only the runtime invocation of
wormhole-mailbox, the complete fix for the test_python_magic_wormhole
runtime test also requires the update of
python-magic-wormhole-transit-relay.
[1] 51365ff063
[2] https://github.com/magic-wormhole/magic-wormhole-mailbox-server/blob/0.6.0/setup.py#L37
Signed-off-by: Julien Olivain <ju.o@free.fr>
[Marcus: remove python-setuptools select from Config.in]
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Remove the Old stable row, it is now thoroughly EOL.
Also remove the commented-out Candidate row. This update was done with
a (draft) script [1], and the script gets confused by the commented-out
row. The script is able to generate the row for a -rc1 release, so
there is no need for the commented-out row.
[1] https://gitlab.com/buildroot.org/buildroot-lts-tools/-/blob/main/tools/prepare-release?ref_type=heads
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
Now that all Xilinx boards have been bumped to Linux 6.12.70, remove the hash
for the xlnx_rebase_v6.12_LTS_merge_6.12.60 release tag.
Signed-off-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Bump the versal2 defconfigs to Linux 6.12.70.
Run tested on a versal2 vek385 evaluation board.
Signed-off-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Bump the versal defconfigs to Linux 6.12.70.
Run tested on a versal vek280 evaluation board.
Signed-off-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Bump the zynqmp defconfigs to Linux 6.12.70.
Run tested on a zynqmp zcu102 evaluation board.
Run tested on a kria kv260 evaluation board.
Signed-off-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Bump the zynq defconfigs to Linux 6.12.70.
Run-tested on a ZC702 Evaluation Board.
Signed-off-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
https://github.com/OpenSC/libp11/blob/libp11-0.4.18/NEWS
Removed all patches which are included in this release.
Switched to sha256 tarball hash provided by upstream.
Apply the fix for enginesdir to the newly introduced configure option
--with-modulesdir, added in version 0.4.14, as well:
8ff7952a81
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
libftdi1's commit 2a992306c0acf938b29fa0cd5fbc160e24424209 introduced
support for independent static/shared library building. But the proper
building of the ftid_eeprom tool was introduced later in commit
eaf42c00bfab5d6bbd8106b11a697ff4f2d7659f. So let's update to the latest
commit that also includes other fixes:
92d657bcb543a9622947d984d4a8e725fb680e8c ChangeLog: Add license clarifications
06fa7fa342a6976a3745894b46babfa5fde841f7 ftdipp: Add wrapper for ftdi_set_module_detach_mode()
120c3495ba82ae9c35a7518248b2e45dfbc36ea7 Merge branch 'prepare-release'
c4b7675a43dcd8fa7c1c42708d5665a2a02e86e4 Set version number to 1.6rc1
c0c8c923829e1c391d7ca951e12b50092d6435f1 Prepare changelog for 1.6rc1
9341a7e8efc07c213c872ced62fc03c03a270b44 Increase copyright year to 2026
f9301536f4004d42cec4dd36f2505679459aae4e Update AUTHORS with contributors since v1.5
ed9d31e41a6ec695fd610e4d718ccc8bb6aefa4b Merge branch 'clarify-license'
84497180578f481758042c73eee9ec0eb60bace3 COPYING.LIB: Update to LGPL v2.1
4ec5bc584c27c333f74eca524de5a0839c983935 LICENSE: Clarify the main ftdi lib is LGPL v2.1 only
61ad454af3e0a886a665659b73729872cfb564a0 LICENSE: Clarify ftdi_eeprom is GPL v2 only
630a27f240fd784c7c3f5d75e7c880eca3a66cf8 Replace tabs in fall-through comments
4f600d690ee0dcbecef4b02edb5700fe84c4a9b3 Modernize Boost detection for CMake 3.30+
f7ed9dd371f9387ed5b715a4f316eea9f85de48d python/CMakeLists.txt: rework Python development files detection
eaf42c00bfab5d6bbd8106b11a697ff4f2d7659f ftdi_eeprom: fix static build
f554d7cd432d3056b1ca62bf09cc4003bf307912 Ignore JetBrains IDE files
019f48462836c9f3a0a1f113a351395ddcf99640 CMake: auto-format all CMake files
Licence files changed due to copyright year change as also some licence
clarifications described in patches:
84497180578f481758042c73eee9ec0eb60bace3
4ec5bc584c27c333f74eca524de5a0839c983935
61ad454af3e0a886a665659b73729872cfb564a0
Fixes:
https://autobuild.buildroot.org/results/8e1299b9ce28df2a848310c5bfb968f59cd8794c/
Signed-off-by: Julien Olivain <ju.o@free.fr>
This version adds support for the wlr-foreign-toplevel-management and
drm-lease-v1 protocols; switches the wlroots dependency to 0.20.0; and
includes a few fixes. Release notes:
https://github.com/cage-kiosk/cage/releases/tag/v0.3.0
Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Security fixes:
CVE-2026-27456 - mount(8) TOCTOU symlink attack via loop device.
The SUID mount follows symlinks when resolving loop backing file
paths. On systems where non-root users are permitted to mount loop
devices (via 'user' option in fstab), this allows access to
arbitrary files.
CWE-190 - Integer overflow in libblkid parse_dos_extended().
A crafted MBR disk image can cause uint32_t wraparound in EBR
chain processing, causing reported partitions to not match the
on-disk layout. Tools like udisks may then register a partition
at logical sector 0.
Full release notes: https://www.kernel.org/pub/linux/utils/util-linux/v2.41/v2.41.4-ReleaseNotes
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Commit [1] "package/fakeroot: bump to version 1.37.2" introduced an
incorrect hash file format. The command "make check-package" reports
the error:
package/fakeroot/fakeroot.hash:2: expected three fields (https://nightly.buildroot.org/#adding-packages-hash)
This commit fixes that.
[1] a4f2419164
Signed-off-by: Julien Olivain <ju.o@free.fr>
This fixes the following vulnerabilities:
- CVE-2026-29111 (fixed in 258.5):
systemd, a system and service manager, (as PID 1) hits an assert and
freezes execution when an unprivileged IPC API call is made with
spurious data. On version v249 and older the effect is not an assert,
but stack overwriting, with the attacker controlled content. From
version v250 and newer this is not possible as the safety check causes
an assert instead. This IPC call was added in v239, so versions older
than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11
contain patches. No known workarounds are available.
https://www.cve.org/CVERecord?id=CVE-2026-29111
- CVE-2026-40226 (fixed in 258.6):
In nspawn in systemd 233 through 259 before 260, an escape-to-host
action can occur via a crafted optional config file.
https://www.cve.org/CVERecord?id=CVE-2026-40226https://github.com/systemd/systemd/security/advisories/GHSA-9mj4-rrc3-gjcx
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
[Marcus: note which minor versions included the respective security fixes]
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
See NEWS:
https://codeberg.org/ivarch/pv/src/tag/v1.10.5/docs/NEWS.md
Changes in 1.10.5:
- Fix --bits option rate calculation and --gauge compatibility
- Security: ignore TMP/TMPDIR, improve memory safety
- Fix terminal state garbling on exit with --cursor
- Improve ETA calculation across suspend/resume
- Better --watchfd and --line-mode handling
- Address issues found by security audit tools
Signed-off-by: Shubham Chakraborty <chakrabortyshubham66@gmail.com>
[Julien:
- move DEVELOPER entry in a separate commit
- add link to NEWS in commit log
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
The host-mkpasswd package needs the <crypt.h> header file installed
on the host. This file was initially provided by the libc headers,
as part of its libcrypt implementation. libcrypt was removed in
glibc 2.39. Most Linux distributions continued to ship a libcrypt
replacement such as libxcrypt in their default installation.
Some mainstream Linux distribution (such as Debian testing) are
now starting to remove this libcrypt and <crypt.h> header from their
default image (of development files).
In that case, host-mkpasswd is failing to build with the error:
/buildroot/output/build/host-mkpasswd/mkpasswd.c:54:10: fatal error: crypt.h: No such file or directory
The issue can be reproduced by adapting the Buildroot Docker file,
by setting "FROM debian:testing-20260316" in [1] and removing
the build of tar.
Note: debian 13 (for example Docker tag trixie-20260316) still
includes the libcrypt-dev package by default, which provides crypt.h.
In Buildroot, there is already the host-heimdal and host-systemd
packages requiring host-libxcrypt. Also, the host-libxcrypt is a
small standalone package. For those reasons, instead of adding
the Buildroot prerequisite on the user host to provide a libcrypt
implementation, this commit simply add the package dependency to
host-libxcrypt, to make sure it will work in all situations.
[1] https://gitlab.com/buildroot.org/buildroot/-/blob/2026.02/support/docker/Dockerfile#L11
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
