Commit Graph

81105 Commits

Author SHA1 Message Date
Romain Naour
39b2b6e4a3 package/python-pybind: overwrite 'pybind11/_version.py' with a hard-coded version
Fixes build error with python-pillow since its version bump to 12.0.0
which introduced a dependency to pybind with buildroot commit
5f446a8d6d:

FileNotFoundError: [Errno 2] No such file or directory:
 '/home/bernd/buildroot/output/host/lib/python3.13/site-packages/include/pybind11/detail/common.h'

Implement the solution suggested by Vincent Fazio [1]:
Generate `pybind11/_version.py` file with a hard-coded version to avoid
copying pybind11 headers in HOST_DIR.

Fixes:
  https://gitlab.com/buildroot.org/buildroot/-/jobs/13138981946 (TestPythonPybind)

[1] https://lists.busybox.net/pipermail/buildroot/2026-February/796082.html

Cc: Vincent Fazio <vfazio@xes-inc.com>
Cc: James Hilliard <james.hilliard1@gmail.com>
Cc: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Tested-by: Vincent Fazio <vfazio@xes-inc.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-02-22 19:57:17 +01:00
Giulio Benetti
f0d1308529 package/bind: bump version to 9.18.45
Release notes:
https://ftp.isc.org/isc/bind9/9.18.45/doc/arm/html/notes.html

Changelog:
https://ftp.isc.org/isc/bind9/9.18.45/doc/arm/html/changelog.html

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
[Julien: fix signature url in license hash file comment]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-02-22 19:27:16 +01:00
Bernd Kuhls
5e7e7c5a66 package/qemu: Remove CRIS support
Buildroot commmit edfc67fb1a bumped the
package from 9.1.0 to 9.2.0 without removing support for CRIS which was
removed upstream in version 9.2.0:
01d01edc9f

https://wiki.qemu.org/ChangeLog/9.2
"The CRIS target has been removed without replacement"

Fixes:
https://autobuild.buildroot.net/results/376/376ea96ddfc0f220bca8bd241614303747f61bd4/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-02-22 18:45:07 +01:00
Bernd Kuhls
f90d38dafc package/wmctrl: fix tarball URL
Current site is down, switch to Debian.

Fixes:
https://autobuild.buildroot.net/results/679/679a9f6224d1771ec2ab52e45fd74af8d03c1604/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2026-02-21 14:28:55 +01:00
Peter Korsgaard
07008c8f2a CHANGES: correct 2025.11.2 release date
Reported-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2026-02-20 12:34:14 +01:00
Peter Korsgaard
47eced3d05 website/download.html: correct 2025.02.11 / 2026.02-rc1 entries
The 2026.02-rc1 release forgot to update the series and date and the
2025.02.11 release forgot to update the data, fix that.

Reported-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2026-02-20 11:10:07 +01:00
Thomas Perale
6ea50235a2 CHANGES: update for 2025.11.2
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit c1143cd06c)
2026-02-20 09:21:57 +01:00
Thomas Perale
4a7d1c029c CHANGES: update for 2025.02.11
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 25dfd17a11)
2026-02-20 09:21:04 +01:00
Arnout Vandecappelle
c5b3baacaf docs/website/{download,news}.html: update for 2025.02.11 and 2025.11.2
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2026-02-20 09:19:36 +01:00
Marcus Hoffmann
91a0ef5183 package/systemd: bump to 258.4
Changes: https://github.com/systemd/systemd/compare/v258.3...v258.4

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2026-02-20 07:52:24 +01:00
Bernd Kuhls
5a08bca31b {linux, linux-headers}: bump 5.{10, 15}.x / 6.{1, 6, 12, 18, 19}.x series
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2026-02-20 07:50:51 +01:00
Giulio Benetti
34b9d6381e board/olimex/a20_olinuxino/patches/linux/linux.hash: drop unused Linux 6.18.3 hash
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-02-19 18:54:44 +01:00
Giulio Benetti
86a5ec97b4 configs/olimex_a20_olinuxino_lime2: bump Linux to version 6.18.8
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-02-19 18:54:37 +01:00
Giulio Benetti
854e7443ca configs/olimex_a20_olinuxino_lime: bump Linux to version 6.18.8
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-02-19 18:54:29 +01:00
Manuel Diener
07006bb735 package/python-fastapi: bump to version 0.129.0
See the release notes here: https://fastapi.tiangolo.com/release-notes//\#01290

Signed-off-by: Manuel Diener <manuel.diener@oss.othermo.de>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
2026-02-19 15:31:17 +01:00
Manuel Diener
7dfa4d3a25 package/python-starlette.mk: bump to version 0.52.1
See the release notes here: https://starlette.dev/release-notes/
This also includes the versions 0.51.0 and 0.52.0

Signed-off-by: Manuel Diener <manuel.diener@oss.othermo.de>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
2026-02-19 15:31:09 +01:00
Manuel Diener
575bd0d04d package/python-jsonschema: bump to version 4.26.0
See the release notes here:
https://github.com/python-jsonschema/jsonschema/blob/main/CHANGELOG.rst/\#v4260

Signed-off-by: Manuel Diener <manuel.diener@oss.othermo.de>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
2026-02-19 14:41:48 +01:00
Manuel Diener
d3d5566292 package/python-anyio: bump to version v4.12.1
See the release notes here:
https://anyio.readthedocs.io/en/stable/versionhistory.html

Signed-off-by: Manuel Diener <manuel.diener@oss.othermo.de>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
2026-02-19 14:36:49 +01:00
James Hilliard
127f36b406 package/ruby: bump to version 4.0.1
Release announce:
https://www.ruby-lang.org/en/news/2026/01/13/ruby-4-0-1-released/

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
[Julien: add link to release announce]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-02-18 22:27:05 +01:00
Bernd Kuhls
06b964b362 package/libzlib: security bump version to 1.3.2
https://github.com/madler/zlib/releases/tag/v1.3.2
https://github.com/madler/zlib/blob/v1.3.2/ChangeLog
https://7asecurity.com/blog/2026/02/zlib-7asecurity-audit/

Updated license hash due to copyright year bumps:
570720b0c2
9e35567064

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-02-18 21:36:34 +01:00
Bernd Kuhls
5c7d9ca80e {linux, linux-headers}: bump 6.{6, 12, 18, 19}.x series
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-02-17 19:14:40 +01:00
Peter Korsgaard
c97a7ad4aa Update for 2026.02-rc1
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2026.02-rc1
2026-02-17 10:29:26 +01:00
Marcus Hoffmann
c38d7326e0 package/systemd: bump to 258.3
Removed patch that fixed building with libseccomp and old kernel headers
as systemd has fixed that upstream now.

Notable changes:
  - Add -Dlibmount=enabled to host and target build. Disabling this
    option disables building most of systemd's tools apart from
    libsystemd.

  - remove gcrypt and gnutls from dependencies and build options.
    openssl is the only supported crypto library now.

  - Disable nspawn build for host variant and add a Config.in option
    for the target variant.

  - systemd now requires kernel >= 5.4 while the recommended kernel
    version moved to >=5.7. This make systemd depend on
    BR2_TOOLCHAIN_HEADERS_AT_LEAST_5_4, removing various dependencies
    on older kernel header versions from sub options.

  - The sha256sum of LICENSES/README.md changed due to various
    license clarification, removal of some vendored files as well as
    changing some file paths. Licensing did not actually change.

For changelog, see:
https://github.com/systemd/systemd/blob/v258.3/NEWS

Tested with `./support/testing/run-tests tests.init.test_systemd`
All tests passed

One of the tests now needs a bigger rootfs size.

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
[Peter: fix check-package warnings]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2026-02-17 09:45:33 +01:00
Michael Nosthoff
41eb6620f4 package/catch2: bump to version 3.13.0
changelog:
https://github.com/catchorg/Catch2/releases/tag/v3.13.0

Signed-off-by: Michael Nosthoff <buildroot@heine.tech>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-02-16 22:45:41 +01:00
Giulio Benetti
50d1dec604 package/libnss: bump version to 3.120.1
For release note, see:
471dd263e1/doc/rst/releases/nss_3_120_1.rst

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
[Julien: fix release notes url in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-02-16 22:41:55 +01:00
Neal Frager
13034387c4 package/binutils-bare-metal: bump to binutils 2.46.0
Bump the binutils-bare-metal package to version 2.46.0.

Release notes can be found here:
https://sourceware.org/pipermail/binutils/2026-February/148149.html

Signed-off-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-02-16 21:56:24 +01:00
Yann E. MORIN
388b9b5965 package/skopeo: bump to 1.22.0
Release notes:
https://github.com/containers/skopeo/releases/tag/v1.22.0

Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-02-16 21:37:53 +01:00
Alexis Lothoré
3b52fe6f2e package/dtc: fix host build with glibc 2.43
When trying to build host-dtc on a host with glibc 2.43, the build fails
on the following error:

  libfdt/fdt_overlay.c: In function ‘overlay_fixup_phandle’:
  libfdt/fdt_overlay.c:424:21: error: assignment discards ‘const’
  qualifier from pointer target type [-Werror=discarded-qualifiers]
    424 |                 sep = memchr(fixup_str, ':', fixup_len);
        |                     ^
  libfdt/fdt_overlay.c:434:21: error: assignment discards ‘const’
  qualifier from pointer target type [-Werror=discarded-qualifiers]
    434 |                 sep = memchr(name, ':', fixup_len);
        |                     ^
  fdtput.c: In function ‘create_node’:
  fdtput.c:235:11: error: assignment discards ‘const’ qualifier from
  pointer target type [-Werror=discarded-qualifiers]
    235 |         p = strrchr(node_name, '/');
        |           ^
  cc1: all warnings being treated as errors
  make[2]: *** [Makefile:359: fdtput.o] Error 1
  make[2]: *** Waiting for unfinished jobs....
  cc1: all warnings being treated as errors
  make[2]: *** [Makefile:359: libfdt/fdt_overlay.o] Error 1
  make[1]: *** [package/pkg-generic.mk:273:
  /home/alexis/src/buildroot/dtc/build/host-dtc-1.7.2/.stamp_built] Error 2
  make: *** [Makefile:83: _all] Error 2

The issue can be reproduced on master with this minimal defconfig on a
host having glibc 2.43:

  BR2_x86_64=y
  BR2_TOOLCHAIN_EXTERNAL=y
  BR2_PACKAGE_QORIQ_MC_UTILS=y

(QORIQ_MC_UTILS will pull HOST_DTC)

This error is due to some functions prototype update in glibc 2.43 for
ISO C23 (see [1], point 3 in the NEWS list). The corresponding fix has
already been integrated upstream, but it has not been released since
then.

Bring the corresponding upstream patch to allow host-dtc to build on
affected hosts.

[1] https://lists.gnu.org/archive/html/info-gnu/2026-01/msg00005.html

Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-02-16 21:19:46 +01:00
Titouan Christophe
31d58806d8 package/kf5/*: bump to v5.116
This is the last (known) release of KDE Frameworks 5, read the announcement
https://kde.org/announcements/frameworks/5/5.116.0/

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-02-16 20:50:01 +01:00
Peter Korsgaard
e78a710e8f configs/openblocks_a6: specify Linux license file
The used Linux kernel (4.14.336) does not contain the default license files
as those were only added in 4.16 with commit e00a844aca ("LICENSES: Add
Linux syscall note exception"), so specify the correct license file to fix:

make legal-info
..
cp: cannot stat '/path/to/output/build/linux-headers-4.14.336/LICENSES/preferred/GPL-2.0': No such file or directory

And add the sha256sum to the .hash file.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
[Julien:
 - reword commit title
 - actually add BR2_LINUX_KERNEL_LICENSE_FILES in defconfig
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-02-16 20:47:04 +01:00
Peter Korsgaard
7bbe1e0979 configs/sheevaplug: specify Linux license file
The used Linux kernel (4.14.336) does not contain the default license files
as those were only added in 4.16 with commit e00a844aca ("LICENSES: Add
Linux syscall note exception"), so specify the correct license file to fix:

make legal-info
..
cp: cannot stat '/path/to/output/build/linux-headers-4.14.336/LICENSES/preferred/GPL-2.0': No such file or directory

And add the sha256sum to the .hash file.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
[Julien: reword commit title]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-02-16 20:47:04 +01:00
Peter Korsgaard
9900ba6208 linux: make license option visible for _CUSTOM_VERSION as well
Commit 50958bcdac ("linux: Add support for custom license files") added a
default value for the license files and made the option visible (E.G.
editable) when a custom VCS or tarball version is used, but it is also
needed for users of an older _CUSTOM_VERSION (E.G.  mainline release), as
the referenced files were only added in Linux 4.16 with commit e00a844aca
("LICENSES: Add Linux syscall note exception"), so change that.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-02-16 20:47:04 +01:00
Peter Korsgaard
541986065a docs/website/news.html: add maintainer announcement
It was recently announced on the list that Marcus joined the maintainer
team, so add a news entry about it as well.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2026-02-16 20:32:54 +01:00
Bernd Kuhls
a5a1171ca3 package/postgresql: security bump version to 18.2
https://www.postgresql.org/about/news/postgresql-182-178-1612-1516-and-1421-released-3235/

Fixes CVE-2026-2003, CVE-2026-2004, CVE-2026-2005, CVE-2026-2006 &
CVE-2026-2007.

Updated license hash due to copyright year bump:
https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=aa4b5ebc7640f60905cd4c71db45674e5941b611

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Reviewed-by: Maxim Kochetkov <fido_max@inbox.ru>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2026-02-16 20:06:37 +01:00
Martin Bachmann via buildroot
53445ca641 package/util-linux: correct missing comma in license info
A comma was missing after the rfkill license, correct that.

Signed-off-by: Martin Bachmann <martin.bachmann@designwerk.com>
[Peter: reword]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2026-02-16 20:03:23 +01:00
Fiona Klute
beabd8baee package/python-pyasyncore: bump version to 1.0.5
Changes:
https://github.com/simonrob/pyasyncore/releases/tag/v1.0.5

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
2026-02-16 12:44:07 +01:00
Fiona Klute
46baf529c5 package/python-pyasynchat: bump to version 1.0.5
Changes: https://github.com/simonrob/pyasynchat/releases/tag/v1.0.5

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
2026-02-16 12:43:58 +01:00
Fiona Klute
8340535bb3 package/python-textual: bump to version 7.5.0
Changes:
https://github.com/Textualize/textual/releases/tag/v7.0.1
https://github.com/Textualize/textual/releases/tag/v7.0.2
https://github.com/Textualize/textual/releases/tag/v7.0.3
https://github.com/Textualize/textual/releases/tag/v7.1.0
https://github.com/Textualize/textual/releases/tag/v7.2.0
https://github.com/Textualize/textual/releases/tag/v7.3.0
https://github.com/Textualize/textual/releases/tag/v7.4.0
https://github.com/Textualize/textual/releases/tag/v7.5.0

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
2026-02-16 11:54:58 +01:00
Fiona Klute
4142783e10 package/python-rich: bump to version 14.3.2
Changes:
https://github.com/Textualize/rich/releases/tag/v14.2.0
https://github.com/Textualize/rich/releases/tag/v14.3.0
https://github.com/Textualize/rich/releases/tag/v14.3.1
https://github.com/Textualize/rich/releases/tag/v14.3.2

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
2026-02-16 11:49:40 +01:00
Bernd Kuhls
6f1842ad2d package/kodi-pvr-mythtv: bump version to 21.2.15-Omega
https://github.com/janbar/pvr.mythtv/blob/21.2.15-Omega/pvr.mythtv/changelog.txt

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2026-02-15 23:18:16 +01:00
Bernd Kuhls
11c8c6e81d package/intel-vpl-gpu-rt: bump version to 26.1.2
https://github.com/intel/vpl-gpu-rt/releases/tag/intel-onevpl-26.1.2

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2026-02-15 23:17:53 +01:00
Bernd Kuhls
576ce5a373 package/intel-mediadriver: bump version to 26.1.2
https://github.com/intel/media-driver/releases/tag/intel-media-26.1.2

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2026-02-15 23:17:44 +01:00
Bernd Kuhls
b034877ca4 package/php: security bump version to 8.5.3
Fixes a number of hangs and crashes found by fuzzing, a stack overflow and a
use-after-free bug.

https://www.php.net/ChangeLog-8.php#8.5.3

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2026-02-15 23:14:47 +01:00
Edgar Bonet
df61ce39c1 configs/acmesystems_acqua_a5_*: remove at91bootstrap3 license
When using a specific git repo and version for at91bootstrap3,
BR2_TARGET_AT91BOOTSTRAP3_LICENSE_FILES defaults to "LICENSES/MIT.txt".
However the git version we use (namely v3.10.3) does not provide this
file. Actually, it does not provide a license file at all. This causes
‘make legal-info’ to fail with:

>>> at91bootstrap3 v3.10.3 Collecting legal info
sha256sum: /builds/buildroot.org/buildroot/output/build/at91bootstrap3-v3.10.3/LICENSES/MIT.txt: No such file or directory
ERROR: while checking hashes from boot/at91bootstrap3/at91bootstrap3.hash
ERROR: LICENSES/MIT.txt has wrong sha256 hash:
ERROR: expected: 5a3809b1c2ba13b7242572322951311c584419f1f8516f665d6c06f0668d78de
ERROR: got     :
ERROR: Incomplete download, or man-in-the-middle (MITM) attack

Let's be explicit that there is no license file to check.

Fixes:
 - https://gitlab.com/buildroot.org/buildroot/-/jobs/12992815386
 - https://gitlab.com/buildroot.org/buildroot/-/jobs/12992815390

Signed-off-by: Edgar Bonet <bonet@grenoble.cnrs.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2026-02-15 23:13:20 +01:00
Dario Binacchi
429bcb111b package/less: bump to version 692
For change log, see:
https://www.greenwoodsoftware.com/less/news.692.html

Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-02-15 19:41:25 +01:00
Bernd Kuhls
6dcf28eaa8 package/coreutils: bump version to 9.10
Upstream does not provide hashes in sha1/sha256 format anymore.

https://lists.gnu.org/archive/html/coreutils-announce/2025-11/msg00000.html

https://lists.gnu.org/archive/html/coreutils-announce/2026-02/msg00000.html
"'kill' and 'uptime' are no longer built by default.  These programs
 can be built with the --enable-install-program=kill,uptime configure
 option."

Adjust coreutils.mk to install 'kill' and 'uptime'.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-02-15 18:15:28 +01:00
Thomas Perale
d94d4ff0a6 package/haproxy: security bump to v2.6.23
For more information on the release, see:
  - https://git.haproxy.org/?p=haproxy-2.6.git;a=commit;h=c3bf1ac6709072bf9984c829c3badda5a4e8fa7e

This fixes the following vulnerability:

- CVE-2025-11230:
    Inefficient algorithm complexity in mjson in HAProxy allows remote
    attackers to cause a denial of service via specially crafted JSON
    requests.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2025-11230
  - https://www.haproxy.com/blog/october-2025-cve-2025-11230-haproxy-mjson-library-denial-of-service-vulnerability

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-02-15 18:10:09 +01:00
Thomas Perale
d6e219adf0 package/haproxy: ignore CVE-2023-45539
The CVE-2023-45539 has incomplete informations (see [1]) and will be
reported as exploitable by pkg-stats for haproxy v2.6.22.

The vulnerability has been fixed upstream since version 2.6.15 [2][3].

This commit mark this vulnerability as ignored.

[1] https://nvd.nist.gov/vuln/detail/CVE-2023-45539
[2] https://git.haproxy.org/?p=haproxy-2.6.git;a=commit;h=832b672eee54866c7a42a1d46078cc9ae0d544d9
[3] https://security-tracker.debian.org/tracker/CVE-2023-45539

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-02-15 18:10:09 +01:00
Thomas Perale
073c6af03e package/busybox: patch CVE-2025-60876
This commit fixes the following vulenerability:

- CVE-2025-60876:
    BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0
    control bytes in the HTTP request-target (path/query), allowing the
    request line to be split and attacker-controlled headers to be
    injected. To preserve the HTTP/1.1 request-line shape METHOD SP
    request-target SP HTTP/1.1, a raw space (0x20) in the request-target
    must also be rejected (clients should use %20).

For more information, see:
    - https://www.cve.org/CVERecord?id=CVE-2025-60876
    - https://lists.busybox.net/pipermail/busybox/2025-November/091840.html
    - https://sources.debian.org/data/main/b/busybox/1%3A1.37.0-10/debian/patches/wget-disallow-control-chars-in-URLs-CVE-2025-60876.patch

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-02-15 16:29:57 +01:00
Julien Olivain
0a24ac1307 docs/website/{download, news}.html: fix date and url typos
The Buildroot commit [1] introduced two small typos, while doing the
updates to announce new releases.

The version 2025.02.10 release date is 2026-01-20 (and not 2022).
See the original announce [2].

The 2025.02.10 archive link in news.html has also a missing dot.

This commit fixes those typo in order to fix the website.

[1] 21dda0665e
[2] https://lore.kernel.org/buildroot/9b9654f8-6cdd-4108-b932-79509e455148@rnout.be/

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2026-02-15 10:16:21 +01:00