mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-10-22 00:41:55 -09:00
Code Issues Packages Projects Releases Wiki Activity
83,981 Commits 6 Branches 485 Tags
6a9ea2a8bfecf9fc1bb4c8e14106ca11410af72e
Commit Graph

83981 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Bernd Kuhls
6a9ea2a8bf package/go: security bump version to 1.27.2 
https://go.dev/doc/devel/release#go1.27.2
https://groups.google.com/g/golang-announce/c/U2fTuyDJznI/m/bAPU-QKAAQAJ

Fixes CVE-2026-56857, CVE-2026-56866, CVE-2026-78659, CVE-2026-78660,
CVE-2026-78663, CVE-2026-78667, CVE-2026-78669, CVE-2026-94439,
CVE-2026-94440, CVE-2026-94444, CVE-2026-94447, CVE-2026-94448,
CVE-2026-97030, CVE-2026-97031 & CVE-2026-97032.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2026-10-09 00:09:57 +02:00
Bernd Kuhls
dbf47e3028 package/tor: security bump version to 0.4.9.14 
https://gitlab.torproject.org/tpo/core/tor/-/blob/tor-0.4.9.14/ReleaseNotes?ref_type=tags

Fixes TROVE-2026-062, TROVE-2026-064 & TROVE-2026-067.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2026-10-09 00:09:38 +02:00
Bernd Kuhls
b6525e9cf8 package/expat: security bump version to 2.9.0 
https://github.com/libexpat/libexpat/blob/R_2_9_0/expat/Changes
https://blog.hartwork.org/posts/expat-2-9-0-released/

Fixes CVE-2026-77214 & CVE-2026-102633.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2026-10-08 00:10:26 +02:00
Bernd Kuhls
43d55a6d9c package/openvpn: security bump version to 2.7.8 
https://github.com/OpenVPN/openvpn/blob/v2.7.8/Changes.rst

Fixes CVE-2026-84790 & CVE-2026-88964.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2026-10-08 00:10:04 +02:00
James Hilliard
1ab8f8ef5a package/python-boto3: bump to version 1.43.108 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2026-10-07 17:35:23 +02:00
James Hilliard
95455bb9cc package/python-botocore: bump to version 1.43.108 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2026-10-07 17:34:17 +02:00
Yegor Yefremov
721e51f58a utils/genrandconfig: reject qemu user mode on hosts with large pages 
Qemu in user mode cannot load target binaries laid out for 4k pages
when the host uses larger pages, as the 16k pages of the Asahi Linux
kernel on Apple Silicon. The dynamic loader then fails with e.g.:

  GLib-2.0: error while loading shared libraries: libz.so.1: failed
  to map segment from shared object

or, depending on the target:

  qemu-aarch64: .../GLib-2.0: Error mapping file: Invalid argument
  torque: error while loading shared libraries: libz.so.1: ELF load
  command address/offset not page-aligned

This hits every package running target code through qemu at build
time, i.e. gobject-introspection and nodejs, on mips, sparc64 and
aarch64 alike, and is not something Buildroot can fix in the
packages themselves.

As this only depends on the build host, reject such configurations
in genrandconfig when the host page size is larger than 4k.

Fixes:
https://autobuild.buildroot.org/results/4848e735fe83dfeef4f24d32655c567951fd113a (mips)
https://autobuild.buildroot.org/results/089ddac5bdaaf5650cbc5c26d48952b5bede0ca6 (sparc64)
https://autobuild.buildroot.org/results/c30c6719a0350370ebe3cfe262123727f4057734 (aarch64)

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-07 09:57:53 +02:00
Maxime Chevallier
716a715539 package/linux-tools: selftests: use KHDR_INCLUDES to locate the headers 
Since v6.7 [1], the KHDR_DIR variable isn't used anymore by the kernel
selftest Makefiles to locate the kernel headers. Instead, KHDR_INCLUDES
is used to specify their location. It was only available between v6.5
and v6.7.

Keep KHDR_DIR for compatibility with v6.5 to v6.7 kernels, while
KHDR_INCLUDES is used by both pre 6.5 and post 6.7 kernels.

Let's pass it with the "-isystem" flag, as is done in the default values
used in the selftest makefiles.

[1]: 43e8832fed08 ("Revert "selftests: error out if kernel header files are not yet built"")

Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-07 09:56:56 +02:00
Paul Elder
0594de6b1c package/kmsxx: add kmsprint and kmstest to extra utils 
Add kmsprint and kmstest to the extra utils that are built with the
extra utils option, as they are useful for testing and development.

Signed-off-by: Paul Elder <paul.elder@ideasonboard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-07 09:55:05 +02:00
Paul Elder
0710da403d package/kmsxx: add option for pykms 
Add option to kmsxx to enable building pykms.

Signed-off-by: Paul Elder <paul.elder@ideasonboard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-07 09:54:35 +02:00
Yegor Yefremov
23d71bfd96 package/inadyn: fix mbedtls support 
Since commit 6bab22ca41 ("package/inadyn: bump to v2.10.0"), the
mbedtls condition is written as "$BR2_PACKAGE_MBEDTLS", which make
expands as the variable $B followed by "R2_PACKAGE_MBEDTLS", so the
condition is never true. Without OpenSSL and GnuTLS, inadyn was built
with --disable-ssl even when mbedtls was enabled.

In addition, inadyn uses GnuTLS by default and needs --enable-mbedtls
to use mbedtls, which was never passed.

Fix the condition and pass --enable-mbedtls.

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Assisted-by: Claude:claude-opus-5
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2026-10-07 07:49:01 +02:00
Jesse Talavera
042b25792b package/samba4: enable systemd support 
`--systemd-install-services` just installs samba's unit files,
whereas `--with-systemd` enables samba's own systemd integration,
used to send status updates to systemd.
I needed this because an app I'm writing needs to know
when samba is ready to start serving files.

Signed-off-by: Jesse Talavera <jesse@jesse.tg>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2026-10-07 07:46:24 +02:00
Titouan Christophe
846bdb2222 docs/website: add opengraph image and meta tags 
When linking Buildroot website pages on social media, some platforms will
attempt to display an image. If such an image is not explicitly specified,
then the social media platform will usually take the first "large" image
from that page.

Recently, there was a post on LinkedIn announcing the new sponsorship from
Texas Instruments, linking to https://buildroot.org/sponsors.html [1].
However, because the first "large image" on that page is the logo from
another sponsor (EVS), this is the one that got displayed and it looks
awkward.

To avoid this situation, let's implement the OpenGraph protocol [2], which
is adopted by LinkedIn. Explicitly specify the image, which is the Buildroot
logo with text, exported from the Gimp (.xcf) original image. To avoid
rendering issues due to transparent background on social media platforms,
the logo is exported with a background color.

[1] https://gitlab.com/-/project/2648174/uploads/5e518b0ec5a2f48d154466aaf117e6ab/image.png
[2] https://ogp.me/

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2026-10-06 23:00:13 +02:00
Peter Seiderer
f51bf05d24 package/openssh: security bump version to 10.6p1 
- bump version to 10.6p1 (for details see [1])

[1] https://www.openssh.org/txt/release-10.6

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-10-06 22:20:02 +02:00
James Hilliard
cd28a8cb99 package/python-thrift: bump to version 0.25.0 
Update license hash due to README changes:
09b177a3f6

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2026-10-06 22:04:30 +02:00
Thomas Perale
7de1ed7745 package/wolfssl: security bump to v5.9.4 
See the release note:

- https://github.com/wolfSSL/wolfssl/releases/tag/v5.9.4-stable

This fixes the following vulnerabilities:

- CVE-2026-15442: https://www.cve.org/CVERecord?id=CVE-2026-15442
- CVE-2026-89102: https://www.cve.org/CVERecord?id=CVE-2026-89102
- CVE-2026-89133: https://www.cve.org/CVERecord?id=CVE-2026-89133
- CVE-2026-89134: https://www.cve.org/CVERecord?id=CVE-2026-89134
- CVE-2026-89135: https://www.cve.org/CVERecord?id=CVE-2026-89135
- CVE-2026-89136: https://www.cve.org/CVERecord?id=CVE-2026-89136
- CVE-2026-93302: https://www.cve.org/CVERecord?id=CVE-2026-93302
- CVE-2026-93304: https://www.cve.org/CVERecord?id=CVE-2026-93304
- CVE-2026-94417: https://www.cve.org/CVERecord?id=CVE-2026-94417
- CVE-2026-94418: https://www.cve.org/CVERecord?id=CVE-2026-94418
- CVE-2026-94419: https://www.cve.org/CVERecord?id=CVE-2026-94419

This commit also updates the LICENSING hash, after an exception
was added in upstream commit:
94c657013d

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
[Julien: fix LICENSING hash]
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-10-06 21:51:13 +02:00
Titouan Christophe
5263a5f220 package/redis: security bump to v8.10.2 
See the release notes:
https://github.com/redis/redis/blob/8.10.2/00-RELEASENOTES

No CVE number are mentioned in these notes, however it states:
"Update urgency: `SECURITY`: There are security fixes in the release"

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-10-06 21:20:37 +02:00
Peter Seiderer
6262b9c5bd package/gzip: add upstream patch to fix build for aarch64 
Since Buildroot commit [1] (package/gzip: bump version to 1.15),
gzip fails at build time for Aarch64 with the error:

  In file included from gzip.c:61:
  gzip.h:120:21: error: expected ')' before '+' token
    120 | #  define head (prev+WSIZE)  /* hash head (see deflate.c) */
        |                     ^

The issue was introduced by upstream commit [2], included in
gzip 1.15.

This commit fixes the issue by adding the patch
0001-build-avoid-failure-to-build-on-linux-aarch64.patch
from upstream commit [3], not yet included in a
gzip release.

Fixes:
https://autobuild.buildroot.org/results/3795b23407021e9fbaaf44c9319085c30d7511c1/

[1] fe21a5fe30
[2] https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=ede0a8888a4d3d0750e1651e01f198e2faab5d59
[3] https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=b4ed8e73401968bcad749afb0e636dd3ec205ca7

Reported-by: Waldemar Brodkorb <wbx@openadk.org>
Link: https://lore.kernel.org/buildroot/asJEBMQpD2FYJql2@waldemar-brodkorb.de/
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
[Julien: add info in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-10-06 21:07:51 +02:00
James Hilliard
c1b063571b package/python-pycryptodomex: bump to version 3.24.0 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-10-06 16:54:19 +02:00
James Hilliard
93636456ec package/python-asyncssh: bump to version 2.24.1 
Update license hash due to whitespace cleanup:
eed9632700

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-10-06 16:54:10 +02:00
James Hilliard
c1bee371ac package/python-cryptography: bump to version 50.0.2 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-10-06 16:54:10 +02:00
James Hilliard
960eeaf8e7 package/python-maturin: bump to version 1.15.0 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-10-06 16:54:10 +02:00
James Hilliard
fd8d89880b package/python-rpds-py: bump to version 2026.9.1 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-10-06 16:54:03 +02:00
James Hilliard
52b21e8eb4 package/python-pytz: bump to version 2026.5 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-10-06 16:53:57 +02:00
James Hilliard
c630855cd9 package/python-pyqt5-sip: bump to version 12.20.0 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-10-06 16:53:52 +02:00
James Hilliard
85019ddb13 package/python-platformdirs: bump to version 4.12.3 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-10-06 16:53:28 +02:00
James Hilliard
532aa127b9 package/python-pillow: bump to version 12.3.0 
Update license identifier to MIT-CMU:
22c05e232c

Update license hash due to the copyright holder name update:
7c121637c9

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-10-06 16:53:22 +02:00
James Hilliard
2944d81ae7 package/python-filelock: bump to version 4.0.10 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-10-06 16:53:17 +02:00
Bernd Kuhls
9ae470b3ae package/cifs-utils: bump version to 7.8 
https://lists.samba.org/archive/samba-technical/2026-September/141109.html

Updated _SITE according to release notes.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-10-06 16:31:52 +02:00
Bernd Kuhls
5df4e2d841 package/fetchmail: bump version to 6.6.9 
https://sourceforge.net/p/fetchmail/mailman/message/59406635/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-10-06 16:24:53 +02:00
Bernd Kuhls
40c2d541c0 package/gerbera: bump version to 3.3.0 
https://github.com/gerbera/gerbera/blob/v3.3.0/ReleaseNotes.md

Removed patches which are included in this release.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-10-06 16:07:54 +02:00
Yann E. MORIN
8cfad4f0f4 package/gpsd: backport security fixes for CVE-2026-58459 
Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Cc: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-06 09:57:59 +02:00
Bernd Kuhls
96bac75585 package/python3: remove 2to3 
Upstream release 3.13.0 first included commit
ae00b810d1
which removed the 2to3 program and the lib2to3 module.

Buildroot commit d63e207eb8 bumped the
package from 3.12.9 to 3.13.2 but forgot to remove its handling.

Current versions of Kodi do not need lib2to3.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: fix typo in commit log version "3.13.9" -> "3.12.9"]
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-10-05 21:56:54 +02:00
Bernd Kuhls
261aaa6d63 package/python3: remove configure option --without-cxx-main 
Upstream release 3.12.0 first included commit
398ed84dc4
which removed the configure option --with-cxx-main.

Buildroot commit 36e635d2d5 bumped the
package from 3.11.6 to 3.12.1 but forgot to remove that configure
option.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-10-05 21:56:54 +02:00
Yegor Yefremov
45903c02e3 package/mbedtls: security bump to v3.6.7 
For more information about the release, see:

- https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-3.6.7
- https://github.com/Mbed-TLS/mbedtls/compare/mbedtls-3.6.6..mbedtls-3.6.7

Fixes the following vulnerabilities:

- CVE-2026-50587:
    Timing side-channel in RSA PKCS#1 v1.5 decryption

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-50587
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-rsa-pkcs1-v15-decryption-timing-side-channel/

- CVE-2026-50581:
    Extended master secret calculation failure ignored

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-50581
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-extended-master-secret-calculation-failure-ignored/

- CVE-2026-50640:
    Ignored TLS 1.3 resumption secret derivation error

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-50640
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-ignored-tls13-resumption-secret-derivation-error/

- CVE-2026-50713:
    Heap corruption with early renegotiation after corrupted record
    in DTLS

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-50713
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-heap-corruption-early-renegotiation-corrupted-dtls-record/

- CVE-2026-50584:
    ChaCha20 counter overflow can reuse keystream

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-50584
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-chacha20-counter-overflow-keystream-reuse/

- CVE-2026-73096:
    TLS 1.3 early data integrity failure due to buffered plaintext
    across key change

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-73096
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-tls13-early-data-integrity-failure-key-change/

- CVE-2026-35336:
    Possible buffer overflow in mbedtls_ecdh_calc_secret()

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-35336
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-possible-buffer-overflow-ecdh-calc-secret/

- CVE-2026-50580:
    Remote buffer overflow in TLS 1.2 ECDHE-PSK client handshake

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-50580
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-tls12-ecdhe-psk-client-buffer-overflow/

- CVE-2026-54435:
    Side channel leak in ECC optimized modp

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-54435
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-ecc-optimized-modp-side-channel/

- CVE-2026-50586:
    Information disclosure in TLS 1.2 NewSessionTicket

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-50586
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-tls12-newsessionticket-information-disclosure/

- CVE-2026-50583:
    Out-of-bounds read when parsing a zero-length ECC public key

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-50583
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-zero-length-ecc-public-key-oob-read/

- CVE-2026-50588:
    Out-of-bounds read in TLS 1.2 EC J-PAKE ServerKeyExchange
    parsing

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-50588
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-tls12-ecjpake-serverkeyexchange-oob-read/

- CVE-2026-50579:
    Use-after-free in mbedtls_pkcs7_free() when reusing a PKCS7
    context

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-50579
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-use-after-free-pkcs7-free-reused-context/

- CVE-2026-54441:
    Signature algorithm restrictions not enforced on certificate
    chain

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-54441
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-signature-algorithm-restrictions-certificate-chain/

- CVE-2026-50585:
    Incomplete context reset in mbedtls_ssl_session_reset()

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-50585
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-ssl-session-reset-incomplete-context-reset/

- CVE-2026-73064:
    A random generator fault can compromise TLS data integrity

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-73064
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-random-generator-fault-tls-integrity/

- CVE-2026-25832:
    TLS 1.3 client accepts HelloRetryRequest selecting an
    unadvertised group

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-25832
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-tls13-hrr-unadvertised-group/

- CVE-2026-49300:
    X.509 CA bit forgery via invalid basicConstraints extension

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-49300
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-x509-ca-bit-forgery-invalid-basicconstraints/

It also fixes the following issue, which has no CVE identifier:

- PKCS7 signed data verification accepts weak hash algorithms

For more information, see:
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-pkcs7-weak-hash-algorithms-accepted/

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Assisted-by: Claude:claude-opus-5
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-10-05 17:45:58 +02:00
Thomas Petazzoni
ddaa55ead5 package/libarchive: drop dependency on host-pkgconf 
Commit 95db5707df bumped libarchive to
version 3.8.1, and as part of this, dropped AUTORECONF = YES. This
allowed to drop the host-pkgconf dependency, which was only needed due
to AUTORECONF = YES. However, the host-pkgconf dependency removal was
only done for the target variant of libarchive, and not for the host
variant.

This commit aligns the host variant with the target variant from that
perspective.

This is not tagged as a fix, as nothing was broken.

Cc: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
 2026-10-05 14:01:04 +02:00
Bernd Kuhls
cdddb871d3 package/vlc: security bump to version 3.0.24 
https://code.videolan.org/videolan/vlc/-/blob/3.0.24/NEWS
https://code.videolan.org/videolan/vlc/-/tags/3.0.24

https://www.videolan.org/vlc/releases/3.0.24.html
"Over 130 security fixes across VLC and its bundled libraries"

https://www.videolan.org/security/sb-vlc3024.html
"VLC 3.0.24 fixes over 50 security issues in VLC itself."

Upstream removed unmaintainted libschroediner library:
614914f7bb

Upstream removed support for mfx, which was disabled in buildroot, and
replaced it with optional support for libvpl:
dcd1e9f447

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2026-10-05 13:13:00 +02:00
Bernd Kuhls
3b3f1d6d9d package/tzdata: bump version to 2026e 
https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/VXIA4AU73OQL3OZ3ZBZHWIASIIVBGUJV/
https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/L4IGHJRBUQR53F7RTEHM5IS7ZMBR3YXP/
https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/NVHSX2PAQIT44U5FCCEVNJJYXQMMTJSA/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2026-10-05 13:09:47 +02:00
Bernd Kuhls
57ed2d0d68 package/hwdata: bump version to 0.412 
https://github.com/vcrhonek/hwdata/releases/tag/v0.412

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2026-10-05 13:09:37 +02:00
Bernd Kuhls
c29ff5b9b3 package/gnupg2: bump version to 2.5.24 
https://lists.gnupg.org/pipermail/gnupg-announce/2026q3/000516.html
"Note that version 2.5.23 was released yesterday but had a regression
 in the smartcard detection code; which is fixed by this release."

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-10-04 21:31:36 +02:00
Bernd Kuhls
8692b78942 package/ccache: bump version to 4.14.1 
https://ccache.dev/releasenotes.html#_ccache_4_14.1

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-10-04 21:09:47 +02:00
Fengwei Tan
a7d47860f3 package/btop: new package 
Btop++ is a resource monitor that shows usage and stats for processor,
memory, disks, network and processes.

https://github.com/aristocratos/btop

Signed-off-by: Fengwei Tan <tfx2001@outlook.com>
[Julien: move the "v" from _VERSION to _SITE]
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-10-04 21:05:49 +02:00
Bernd Kuhls
cb129a641b package/iperf3: security bump version to 3.22 
https://github.com/esnet/iperf/blob/3.22/RELNOTES.md

Fixes CVE-2026-101283, CVE-2026-101276, CVE-2026-102253, CVE-2026-71217.

"The iperf-3.18 release notes were updated to reflect that a code change
 in that version addresses CVE-2026-71218."

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2026-10-04 18:13:22 +02:00
Bernd Kuhls
5feefc6be0 package/libheif: security bump version to 1.23.5 
https://github.com/strukturag/libheif/releases/tag/v1.23.5

Fixes the following CVEs:

(CVE numbers will be added when assigned.)

CVE-2026-XXXXX (GHSA-v8qw-hwjv-44hw)
CVE-2026-XXXXX (GHSA-qwpf-5wf7-r996)
CVE-2026-XXXXX (GHSA-9c75-9g8r-4728)
CVE-2026-XXXXX (GHSA-r7gr-2xm2-23wf)
CVE-2026-XXXXX (GHSA-q492-cfcm-895h)

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2026-10-04 18:12:47 +02:00
James Hilliard
b12c9294ff package/python-urwid: bump to version 4.2.4 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-04 18:03:17 +02:00
James Hilliard
3e6f6cec20 package/python-sqlalchemy: bump to version 2.1.3 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-04 18:03:15 +02:00
James Hilliard
51de4cb8aa package/python-simplejson: bump to version 4.2.0 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-04 18:03:13 +02:00
James Hilliard
5914a445d9 package/python-selenium: bump to version 4.50.0 
Update license hash due to copyright year update:
fbd3b6de2f

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-04 18:03:10 +02:00
James Hilliard
a398dc7a54 package/python-ruamel-yaml: bump to version 0.19.1 
Update license hash due to copyright year update:
6846cf136e/

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-04 18:03:07 +02:00
James Hilliard
dd7096fbbd package/python-regex: bump to version 2026.9.29 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-04 18:03:03 +02:00