Commit Graph

77720 Commits

Author SHA1 Message Date
Bernd Kuhls
7e76ce3289 package/apache: security bump version to 2.4.65
Changelog:
https://downloads.apache.org/httpd/CHANGES_2.4.65

Fixes:
https://www.cve.org/CVERecord?id=CVE-2025-54090

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit ebb6648046)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-08-07 19:09:07 +02:00
Bernd Kuhls
e9b8986841 package/rust-bindgen: security bump version to 0.72.0
Changelog, since version 0.65.1:
https://github.com/rust-lang/rust-bindgen/blob/v0.72.0/CHANGELOG.md#0720-2025-06-08

The package updated some of its dependencies to fix
security issues:

Version 0.70.0 updates "tempfile" and "rustix" to fix:
https://github.com/advisories/GHSA-c827-hfw6-qwvm
https://www.cve.org/CVERecord?id=CVE-2024-43806

Version 0.69.3 updates shlex to fix:
https://rustsec.org/advisories/RUSTSEC-2024-0006.html

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien:
 - use version tag for change log url
 - mark the update as security related
 - add link to fixed rustix CVE
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 1a229c54b8)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-08-07 19:09:05 +02:00
El Mehdi YOUNES
915ee9cd4f utils/update-rust: fix MIT hash
The LICENSE-MIT file has changed.
Commit 432aef05 fixed it for rust package but forgot
the update-rust script.

Signed-off-by: El Mehdi YOUNES <elmehdi.younes@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit b97175b49a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-08-07 19:09:03 +02:00
Bernd Kuhls
805aee8226 {linux, linux-headers}: bump 5.{4, 10, 15}.x / 6.{1, 6, 12}.x series
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 065c1b84b5)
[thomas: drop 6.15]
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-08-07 19:09:01 +02:00
Yegor Yefremov
a331907858 package/avrdude: remove the obsolete hook
Since its introduction in commit [1], avrdude has a post install
target hook removing a backup configuration file.

Commit [2] updated avrdude to version 7.1 and switch to the
cmake infra.

CMake recipe doesn't create a backup of the avrdude.conf.

This commit removes this hook which is no longer needed.

[1] dc776f0d05
[2] f89f3787a0

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
[Julien: add extra info in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 51cf8e5663)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-08-07 19:08:59 +02:00
Fiona Klute
b15d605d0d package/lrzsz: fix build with musl
lib/long-options.c failed to compile with musl for the same reason
0002-lib-long-options.c-include-stdlib.h.patch was added to fix,
exit() being undefined. The fix is the same as well: include stdlib.h.

Fixes: b6784a1f1f ("package/lrzsz: fix build with GCC >= 14.x")
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 54240460dc)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-08-07 19:08:57 +02:00
Titouan Christophe
9e9f3b9a15 package/python-starlette: security bump to v0.47.2
For release note, see:
https://github.com/encode/starlette/releases/tag/0.47.2

This fixes the following vulnerability:

- CVE-2025-54121:
    Starlette is a lightweight ASGI (Asynchronous Server Gateway
    Interface) framework/toolkit, designed for building async web services
    in Python. In versions 0.47.1 and below, when parsing a multi-part
    form with large files (greater than the default max spool size)
    starlette will block the main thread to roll the file over to disk.
    This blocks the event thread which means the application can't accept
    new connections. The UploadFile code has a minor bug where instead of
    just checking for self._in_memory, the logic should also check if the
    additional bytes will cause a rollover. The vulnerability is fixed in
    version 0.47.2.
    https://www.cve.org/CVERecord?id=CVE-2025-54121

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Reviewed-by: Marcus Hoffmann <buildroot@bubu1.eu>
[Julien: add link to release note]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 8945ea3e67)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-08-07 19:08:55 +02:00
Lance Fredrickson
a89d3b4070 package/ncurses: bump to version 6.5.20250720
Release notes:
https://github.com/ThomasDickey/ncurses-snapshots/blob/v6_5_20250720/NEWS

Fixes observed issues with htop on aarch64/musl after the last ncurses update.

Signed-off-by: Lance Fredrickson <lancethepants@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 1471c9b421)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-08-07 19:08:53 +02:00
Markus Mayer
50c07d88fd toolchain/toolchain-wrapper.c: fix indentation
A recent commit introduced a few lines that were indented with spaces
rather than a tab. Rectify this.

Fixes: 00b30f887a ("toolchain-wrapper.c: get rid of EXCLUSIVE_ARGS")
Signed-off-by: Markus Mayer <mmayer@broadcom.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 5e4cb7607b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-08-07 19:08:51 +02:00
Giulio Benetti
23cc7bde08 package/rtl8821au: update upstream
Benetti Engineering just took over Larry Finger(lwfinger)'s repository [0]
rtl8821au since Larry unfortunately passed away[1](RIP) and there are
pending PRs that will never be checked as stated here. So basically move
github user to benetti-engineering-sas and update version with latest that
fixes build failure with Linux version 6.15. And of course let's update
package's URL due to the moving.

[0]: https://github.com/lwfinger/rtl8812au/issues/32
[1]: https://lwn.net/Articles/979419/

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 2dd7a4a374)
[thomas: only change the upstream]
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-08-07 19:08:49 +02:00
Giulio Benetti
a9df497204 package/rtl8723ds: update upstream
Benetti Engineering just took over Larry Finger(lwfinger)'s repository [0]
rtl8723ds since Larry unfortunately passed away[1](RIP) and there are
pending PRs that will never be checked as stated here. So basically move
github user to benetti-engineering-sas and update version with latest that
fixes build failure with Linux version 6.15. And let's drop local patches
that are now upstreamed as well. And of course let's update package's
URL due to the moving.

[0]: https://github.com/lwfinger/rtl8723ds/issues/53
[1]: https://lwn.net/Articles/979419/

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 54ee4a71c0)
[thomas: only change the upstream]
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-08-07 19:08:47 +02:00
Giulio Benetti
c743fcdd79 package/rtl8723bu: update upstream
Benetti Engineering just took over Larry Finger(lwfinger)'s repository
rtl8723bu since Larry unfortunately passed away[0](RIP) and there are
pending PRs that will never be checked as stated here[1]. So basically move
github user to benetti-engineering-sas and update version with latest that
fixes build failure with Linux version 6.15. And of course let's update
package's URL due to the moving.

[0]: https://lwn.net/Articles/979419/
[1]: https://github.com/lwfinger/rtl8723bu/issues/206

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d1fc513da7)
[thomas: only change the upstream]
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-08-07 19:08:45 +02:00
Giulio Benetti
189bdc4d01 package/rtl8188eu: move upstream to Benetti Engineering Github
Benetti Engineering just took over Larry Finger(lwfinger)'s repository
rtl8188eu since Larry unfortunately passed away[0](RIP) and there are
pending PRs that will never be checked as stated here[1]. So basically move
github user to benetti-engineering-sas and update version with latest that
fixes build failure with Linux version 6.15. And let's drop local patches
that are now upstreamed as well. Let's also drop obsolete Config.in
informations since as stated here[2]: "This driver is under development
and has a limited feature set. In particular it does not yet support 40MHz
channels and power management". At the same time drop other suggestions
like enabling CONFIG_WIRELESS_EXT or "this package needs a firmware loading
mechanism to load the binary blob for the chip to work" since they are now
part of the package. And of course let's update package's URL due to the
moving.

[0]: https://lwn.net/Articles/979419/
[1]: https://github.com/lwfinger/rtl8188eu/pull/464

Fixes:
https://autobuild.buildroot.org/results/d59537da8eb27d737718885dc81ec257a2791455/

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit a9c5dc024a)
[Thomas: only change upstream]
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-08-07 19:08:43 +02:00
Peter Korsgaard
7b8400f71b toolchain/toolchain-wrapper.c: get rid of EXCLUSIVE_ARGS
Rather than having a hard coded amount of exclusive args (with the risk of
overflow when new logic is added), simplify the argument buffer allocation
logic to always allocate room for DEFAULT_MAX_ARGS (1024) arguments and just
realloc to grow for the rare situation where that is not enough.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 00b30f887a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-08-07 19:08:42 +02:00
Peter Korsgaard
09da162ef5 toolchain/toolchain-wrapper.c: slightly simplify cmdline copying
C99 section 5.1.2.2.1p2 mandates that:

- argv[argc] shall be a null pointer.

https://www.open-std.org/jtc1/sc22/wg14/www/docs/n1256.pdf

So we might as well copy the null pointer along in the memcpy() rather than
copy everything up to the null pointer and then add one afterwards for
simplicity.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 6b8ffbf97b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-08-07 19:08:40 +02:00
Petr Vorel
325fa4b316 package/ltp-testsuite: backport musl build fixes
When building LTP with a musl toolchain with kernel headers >= 6.14,
compilation fails with error:

    In file included from listmount02.c:22:
    listmount.h: In function ‘listmount’:
    listmount.h:18:16: error: variable ‘req’ has initializer but incomplete type
       18 |         struct mnt_id_req req = {
          |                ^~~~~~~~~~

The issue can be reproduced with commands:

    cat >.config <<EOF
    BR2_aarch64=y
    BR2_TOOLCHAIN_BUILDROOT_MUSL=y
    BR2_LINUX_KERNEL=y
    BR2_LINUX_KERNEL_LATEST_VERSION=y
    BR2_LINUX_KERNEL_USE_ARCH_DEFAULT_CONFIG=y
    BR2_PACKAGE_LTP_TESTSUITE=y
    EOF
    make olddefconfig
    make ltp-testsuite

Backport 2 commits from upstream which fixes LTP on musl on
kernel >= 6.14.

Signed-off-by: Petr Vorel <petr.vorel@gmail.com>
[Julien:
 - add commands to reproduce the issue in commit log
 - move _AUTORECONF up to be nearer _VERSION
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 0ccd9300cd)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-08-07 19:08:38 +02:00
Yegor Yefremov
60b8fb63cc package/watchdog: do not guard shutdown __GLIBC__
These headers are provided by uclibc/musl/glibc and bionic so we can
assume they are not needed to be glibc specific includes. This also
ensures that we get proper declaration of reboot() API.

Upstream:
aa371bf201/

Fixes:
https://autobuild.buildroot.org/results/3e67d5b3b89d794e3f6c510803368f8b100b07a7/

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
[Julien: reformat Upstream: tag in patch to fix check-package error]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit ea797e760b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-08-07 19:08:36 +02:00
Bernd Kuhls
33cc49849d package/ntp: add Upstream tag to patch 0001
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit c72557eaf8)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-08-07 19:08:34 +02:00
Bernd Kuhls
fa1c1f83eb package/ntp: fix build with gcc-14
Fixes:
https://autobuild.buildroot.org/results/114/114a81f216b44a00c5de830e21315df68a62987d/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 526ab2f6c0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-08-07 19:08:32 +02:00
Bernd Kuhls
b4ec33b693 package/ntp: fix OpenSSL detection
Fixes:
https://autobuild.buildroot.org/results/261e630f20dd20b7f606a7bcbd8fa7b50ce82fbe/

The build error occurs when libatomic is needed for linking.
In ntp_openssl.m4 the result of OpenSSL's pkgconf was omitted.

Enable configure option --enable-verbose-ssl to help future debugging:
configure: ntp_ssl_libs_l:   (-lssl -lcrypto -latomic)

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 6a20660c5a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-08-07 19:08:29 +02:00
Gero Schwäricke
4482f1de4f package/rauc-hawkbit-updater: fix missing user
Systemd support for the RAUC hawkbit updater was added in

  4aa7a4ad8a (package/rauc-hawkbit-updater: add systemd optional dependency, 2024-07-10)

This installs the RAUC hawkbit updater service, which executes as user
"rauc-hawkbit" [1], which doesn't exist by default.

[1] 2711c0e027/script/rauc-hawkbit-updater.service

Signed-off-by: Gero Schwäricke <gero.schwaericke@sevenlab.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 69b2777291)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-08-07 19:08:27 +02:00
Fiona Klute (WIWA)
c7f71cc764 package/network-manager: set "nft" path if BR2_PACKAGE_NFTABLES=y
Nftables should be preferred over iptables if available, which
NetworkManager will do if both paths are set.

Signed-off-by: Fiona Klute (WIWA) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 7c8cca9baa)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-08-07 19:08:25 +02:00
Titouan Christophe
e8fcc04257 package/assimp: security bump to v6.0.2
For release notes since version 5.4.3, see:
https://github.com/assimp/assimp/releases

This fixes the following vulnerabilities:

- CVE-2025-2750:
    A vulnerability, which was classified as critical, was found in Open
    Asset Import Library Assimp 5.4.3. This affects the function
    Assimp::CSMImporter::InternReadFile of the file
    code/AssetLib/CSM/CSMLoader.cpp of the component CSM File Handler. The
    manipulation leads to out-of-bounds write. It is possible to initiate
    the attack remotely. The exploit has been disclosed to the public and
    may be used.
    https://www.cve.org/CVERecord?id=CVE-2025-2750

- CVE-2025-2751:
    A vulnerability has been found in Open Asset Import Library Assimp
    5.4.3 and classified as problematic. This vulnerability affects the
    function Assimp::CSMImporter::InternReadFile of the file
    code/AssetLib/CSM/CSMLoader.cpp of the component CSM File Handler. The
    manipulation of the argument na leads to out-of-bounds read. The
    attack can be initiated remotely. The exploit has been disclosed to
    the public and may be used.
    https://www.cve.org/CVERecord?id=CVE-2025-2751

- CVE-2025-2757:
    A vulnerability classified as critical was found in Open Asset Import
    Library Assimp 5.4.3. This vulnerability affects the function
    AI_MD5_PARSE_STRING_IN_QUOTATION of the file
    code/AssetLib/MD5/MD5Parser.cpp of the component MD5 File Handler. The
    manipulation of the argument data leads to heap-based buffer overflow.
    The attack can be initiated remotely. The exploit has been disclosed
    to the public and may be used.
    https://www.cve.org/CVERecord?id=CVE-2025-2757

- CVE-2025-3158:
    A vulnerability, which was classified as critical, has been found in
    Open Asset Import Library Assimp 5.4.3. Affected by this issue is the
    function Assimp::LWO::AnimResolver::UpdateAnimRangeSetup of the file
    code/AssetLib/LWO/LWOAnimation.cpp of the component LWO File Handler.
    The manipulation leads to heap-based buffer overflow. It is possible
    to launch the attack on the local host. The exploit has been disclosed
    to the public and may be used.
    https://www.cve.org/CVERecord?id=CVE-2025-3158

Also, drop local security patches that have been applied upstream

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
[Julien: add link to relase notes]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 3c312f149b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-08-07 19:08:23 +02:00
Titouan Christophe
0c37b4367f package/mbedtls: security bump to v3.6.4
This is a security release of the Long Term Support branch, see release notes:
https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-3.6.4

Also update the download location, because upstream changed the tag naming
scheme from v<...> to mbedtls-<...>

This fixes the following vulnerabilities:

- CVE-2025-47917
    Fix possible use-after-free or double-free in code calling
    mbedtls_x509_string_to_names(). This was caused by the function calling
    mbedtls_asn1_free_named_data_list() on its head argument, while the
    documentation did no suggest it did, making it likely for callers relying
    on the documented behaviour to still hold pointers to memory blocks after
    they were free()d, resulting in high risk of use-after-free or double-free,
    with consequences ranging up to arbitrary code execution.
    In particular, the two sample programs x509/cert_write and x509/cert_req
    were affected (use-after-free if the san string contains more than one DN).
    Code that does not call mbedtls_string_to_names() directly is not affected.

- CVE-2025-48965
    Fix a bug in mbedtls_asn1_store_named_data() where it would sometimes leave
    an item in the output list in an inconsistent state with val.p == NULL but
    val.len > 0. This impacts applications that call this function directly,
    or indirectly via mbedtls_x509_string_to_names() or one of the
    mbedtls_x509write_{crt,csr}set{subject,issuer}_name() functions. The
    inconsistent state of the output could then cause a NULL dereference either
    inside the same call to mbedtls_x509_string_to_names(), or in subsequent
    users of the output structure, such as mbedtls_x509_write_names(). This
    only affects applications that create (as opposed to consume) X.509
    certificates, CSRs or CRLs, or that call mbedtls_asn1_store_named_data()

- CVE-2025-49087
    Fix a timing side channel in the implementation of PKCS#7 padding
    which would allow an attacker who can request decryption of arbitrary
    ciphertexts to recover the plaintext through a timing oracle attack.

- CVE-2025-49600:
    In MbedTLS 3.3.0 before 3.6.4, mbedtls_lms_verify may accept invalid
    signatures if hash computation fails and internal errors go unchecked,
    enabling LMS (Leighton-Micali Signature) forgery in a fault scenario.
    Specifically, unchecked return values in mbedtls_lms_verify allow an
    attacker (who can induce a hardware hash accelerator fault) to bypass
    LMS signature verification by reusing stale stack data, resulting in
    acceptance of an invalid signature. In mbedtls_lms_verify, the return
    values of the internal Merkle tree functions create_merkle_leaf_value
    and create_merkle_internal_value are not checked. These functions
    return an integer that indicates whether the call succeeded or not. If
    a failure occurs, the output buffer (Tc_candidate_root_node) may
    remain uninitialized, and the result of the signature verification is
    unpredictable. When the software implementation of SHA-256 is used,
    these functions will not fail. However, with hardware-accelerated
    hashing, an attacker could use fault injection against the accelerator
    to bypass verification.
    https://www.cve.org/CVERecord?id=CVE-2025-49600

- CVE-2025-49601:
    In MbedTLS 3.3.0 before 3.6.4, mbedtls_lms_import_public_key does not
    check that the input buffer is at least 4 bytes before reading a
    32-bit field, allowing a possible out-of-bounds read on truncated
    input. Specifically, an out-of-bounds read in
    mbedtls_lms_import_public_key allows context-dependent attackers to
    trigger a crash or limited adjacent-memory disclosure by supplying a
    truncated LMS (Leighton-Micali Signature) public-key buffer under four
    bytes. An LMS public key starts with a 4-byte type indicator. The
    function mbedtls_lms_import_public_key reads this type indicator
    before validating the size of its input.
    https://www.cve.org/CVERecord?id=CVE-2025-49601

- CVE-2025-52496:
    Mbed TLS before 3.6.4 has a race condition in AESNI detection if
    certain compiler optimizations occur. An attacker may be able to
    extract an AES key from a multithreaded program, or perform a GCM
    forgery.
    https://www.cve.org/CVERecord?id=CVE-2025-52496

- CVE-2025-52497:
    Mbed TLS before 3.6.4 has a PEM parsing one-byte heap-based buffer
    underflow, in mbedtls_pem_read_buffer and two mbedtls_pk_parse
    functions, via untrusted PEM input.
    https://www.cve.org/CVERecord?id=CVE-2025-52497

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
[Julien: fix upstream hash URL in hash file]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 24639e0f72)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-08-07 19:08:21 +02:00
James Hilliard
c4a1b99ef4 package/python-dbus-fast: fix cython 3.1.x compatibility
Since python-cython bump to 3.1.2 in commit [1], python-dbus-fast
is failing to build.

Set --skip-dependency-check as dbus-fast specifies an unnecessarily
strict maximum cython version.

Fixes:
ERROR Missing dependencies:
	Cython<3.1.0,>=3

[1] b536caaec0

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
[Julien: add reference to buildroot commit introducing the issue]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f38d4e63d7)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-08-07 19:08:19 +02:00
Marcus Hoffmann
4e09315fd1 package/python-msgpack: fix project url
The previous url pointed to an unrelated but similarly named project.

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 90fdb03f47)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-08-07 19:08:17 +02:00
Marcus Hoffmann
508bf5a2cf package/python-asgiref: switch upstream URL to https
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit bbfd0951fa)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-08-07 19:08:15 +02:00
Bernd Kuhls
102b89bf9d package/libcddb: Fix build with gcc-14
libcddb fail to build with gcc-14 with error:

    cddb_net.c: In function 'timeout_connect':
    cddb_net.c:328:63: error: passing argument 5 of 'getsockopt' from incompatible pointer type [-Wincompatible-pointer-types]
      328 |                 getsockopt(sockfd, SOL_SOCKET, SO_ERROR, &rv, &l);
          |                                                               ^~
          |                                                               |
          |                                                               size_t * {aka long unsigned int *}

This commit adds a patch to fix the issue.

Fixes:
https://autobuild.buildroot.net/results/723/7236cf5fd4f33aabd3178586f877dff04d754abe/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: add error message in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f1b4657bc0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-08-07 19:08:13 +02:00
Titouan Christophe
c65fa3c7df package/python-aiohttp: fix missing build dependency
Since aiohttp was bumped in e4451602eb,
it now requires pkgconfig at setup time, see upstream commit
40563751ad

Reported-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit dcf9df16d8)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-08-07 19:08:10 +02:00
James Hilliard
e3e5ea1e82 package/python-cython: bump to version 3.1.2
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit b536caaec0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-08-07 19:08:08 +02:00
James Hilliard
d809b87703 package/python-setuptools: bump to version 80.9.0
Rebase add executable patch.

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 0b171693a9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-08-07 19:08:06 +02:00
Titouan Christophe
108ed8dc3f package/python-aiohttp: security bump to v3.12.14
This fixes the following vulnerability:
- CVE-2025-53643:
    In aiohttp prior to version 3.12.14, the Python parser is vulnerable
    to a request smuggling vulnerability due to not parsing trailer
    sections of an HTTP request. If a pure Python version of aiohttp is
    installed (i.e. without the usual C extensions) or
    AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to
    execute a request smuggling attack to bypass certain firewalls or
    proxy protections. Version 3.12.14 contains a patch for this issue.
    https://www.cve.org/CVERecord?id=CVE-2025-53643

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit e4451602eb)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-08-07 19:08:04 +02:00
Yann E. MORIN
0cc802c363 package/podman: security bump to version 5.5.2
For release notes since 5.4.1, see:
https://github.com/containers/podman/releases

The release 5.5.2 includes a security fix for CVE-2025-6032.

Fixes:
https://github.com/advisories/GHSA-65gg-3w2w-hr4h
https://www.cve.org/CVERecord?id=CVE-2025-6032

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
[Julien:
 - mark as a security bump
 - add link to release notes
 - add link to CVE
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit faff38912b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-08-07 19:08:02 +02:00
Yann E. MORIN
d5dd06fb07 support/testing: add a crun-based runtime test for docker-compose
Via the docker-compose runtime test, we can exercise the full suite of
the docker-related packages: docker-compose, of course, but also
docker-engine, which in turn allows exercising containerd. The latter
by defualt uses runc as the container runtime, but can alternatively use
crun.

Extend the docker-compose runtime test with a variant that enables crun.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 34e4480950)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-08-07 19:07:59 +02:00
Yann E. MORIN
321e6745b1 package/passt: needs headers >= 5.0
Upstream passt only documents runtime dependencies; and they advertise
being able to run on kernel 3.8 or later. However, they do not document
the build dependencies.

As reported by Julien, since 2024_12_11.09478d5, upstream requires
kernel headers >= 5.0, as they make use of linux/vhost_types.h, only
introduced in 5.0.

Add a dependency to kernel headers, and propagate it to podman's passt
backend.

Reported-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit ed99b77e5d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-08-07 19:07:57 +02:00
Marcus Hoffmann
522fe8d976 package/python-starlette: bump to 0.47.1
Release notes:
* https://github.com/encode/starlette/releases/tag/0.47.0
* https://github.com/encode/starlette/releases/tag/0.47.1

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit b17a5979c3)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-08-07 19:07:55 +02:00
Marcus Hoffmann
7535596950 package/python-fastapi: bump to 0.116.1
Release notes:
* https://github.com/fastapi/fastapi/releases/tag/0.116.0
* https://github.com/fastapi/fastapi/releases/tag/0.116.1

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 25d8e7f1a0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-08-07 19:07:53 +02:00
Thomas Perale
8f2f6cbca0 package/libesmtp: bump to version v1.1.0-14-g335ee8d to fix build with gcc-14
When building libesmtp on the autobuilder with gcc-14, the
following error occurs:

    /workdir/instance-0/output-1/per-package/libesmtp/host/bin/arc-linux-gcc -Ilibesmtp.so.6.2.0.p -I. -I.. -I/workdir/instance-0/output-1/per-package/libesmtp/host/arc-buildroot-linux-gnu/sysroot/usr/include -fdiagnostics-color=always -Wall -Winvalid-pch -std=c11 -O3 -D_POSIX_C_SOURCE=200809L -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -Os -g0 -D_FORTIFY_SOURCE=2 -fPIC -pthread -MD -MQ libesmtp.so.6.2.0.p/smtp-api.c.o -MF libesmtp.so.6.2.0.p/smtp-api.c.o.d -o libesmtp.so.6.2.0.p/smtp-api.c.o -c ../smtp-api.c
    ../smtp-api.c: In function 'smtp_version':
    ../smtp-api.c:1183:7: error: implicit declaration of function 'strlcpy'; did you mean 'strncpy'? [-Wimplicit-function-declaration]
     1183 |   if (strlcpy (buf, v, len) > len)
          |       ^~~~~~~
          |       strncpy

This error has been fixed upstream in commit [1], but no new release
has been made since.
This patch update the package version to fetch the latest upstream
commit v1.1.0-14-g335ee8d.

For the changes, see:

 - https://github.com/libesmtp/libESMTP/compare/v1.1.0...335ee8d2fa5cb7d30db7b818ec05563ad139ee2f

[1] 972eb54749

Fixes: https://autobuild.buildroot.org/results/ced/ceda012506edccda1727904eb3327017b07e27d8
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
[Julien:
 - mention gcc-14 as the root cause of the build failure
 - use "git describe --tags --abbrev=40" format in _VERSION
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 84077c7776)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-08-07 19:07:51 +02:00
Bernd Kuhls
9fc5178111 package/oniguruma: bump version to 6.9.10
Release notes:
https://github.com/kkos/oniguruma/releases/tag/v6.9.10

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 11818cd07d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-08-07 19:07:49 +02:00
Titouan Christophe
8facccc14e package/redis: security bump to v8.0.3
For release note, see:
https://github.com/redis/redis/releases/tag/8.0.3

This fixes the following vulnerabilities:

- CVE-2025-32023:
    An authenticated user may use a specially crafted string to trigger a
    stack/heap out of bounds write on hyperloglog operations, potentially
    leading to remote code execution.
    https://github.com/redis/redis/security/advisories/GHSA-rp2m-q4j6-gr43

- CVE-2025-48367:
    An unauthenticated connection can cause repeated IP protocol errors,
    leading to client starvation and, ultimately, a denial of service.
    https://github.com/redis/redis/security/advisories/GHSA-4q32-c38c-pwgq

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
[Julien: add link to release note]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit c87ddd6ee4)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-08-07 19:07:47 +02:00
Bernd Kuhls
745acf6a8d package/libcrossguid: bump version to v0.2.2-52-gca1bf4b
Needed for kodi 22.x.

Added build fix for >= gcc-13.

Switched build system to cmake following upstream:
13683c56e5

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: use "git describe --tags --abbrev=40" format for _VERSION]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit c61d7d61b1)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-07-17 22:24:23 +02:00
Marcus Hoffmann
b18a365e49 package/python-typing-extensions: update description
Minimum python version is now 3.9, but also it's not really relevant to
mention this in the package description.

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 8d1d851d78)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-07-17 22:24:22 +02:00
Florian Larysch
d8df38f305 fs: erofs: reword "all-fragments" Kconfig text
Currently, both BR2_TARGET_ROOTFS_EROFS_ALL_FRAGMENTS and
BR2_TARGET_ROOTFS_EROFS_FRAGMENTS have the same Kconfig prompt, making
them hard to distinguish.

Reword the one for -Eall-fragments to be distinct.

Signed-off-by: Florian Larysch <fl@n621.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit df7e428cf5)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-07-17 22:24:20 +02:00
Julien Olivain
142dc23100 package/openblas: bump to version v0.3.30
For change log since v0.3.29, see:
https://github.com/OpenMathLib/OpenBLAS/releases/tag/v0.3.30

Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 565ee4a917)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-07-17 22:24:19 +02:00
Bernd Kuhls
d61bf8b068 package/samba4: bump version to 4.21.7
Release notes:
https://www.samba.org/samba/history/samba-4.21.7.html

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 282e7add88)
[Titouan: Bump to 4.21.7 on buildroot 2025.05]
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-07-17 22:24:18 +02:00
Adrian Perez de Castro
6ad1e1a8a7 package/libdex: bump to version 0.10.1
This is a bugfix release which includes a few improvements and fixes
leaks of Unix signal futures. Release notes:

  https://gitlab.gnome.org/GNOME/libdex/-/blob/0.10.1/NEWS

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 8f427b78a9)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-07-17 22:24:17 +02:00
Adrian Perez de Castro
e1785557ac package/webkitgtk: bump to version 2.48.3
Fixes a number of crashes. Release notes:

  https://webkitgtk.org/2025/05/28/webkitgtk2.48.3-released.html

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 676c4369d9)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-07-17 13:17:50 +02:00
Michael Fischer
aaca2bc830 package/sdl2: bump version to 2.32.8
Bugfix release, fixing various minor issues:
https://github.com/libsdl-org/SDL/releases/tag/release-2.32.8

Signed-off-by: Michael Fischer <mf@go-sys.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d4819ab45f)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-07-17 13:17:43 +02:00
Michael Fischer
fbb1c478bb package/gnuplot: bump version to 6.0.3
For release note, see:
http://www.gnuplot.info/ReleaseNotes_6_0_3.html

SHA256 hash now from:
https://sourceforge.net/projects/gnuplot/files/gnuplot/6.0.3/gnuplot-6.0.3.tar.gz.sha256

Signed-off-by: Michael Fischer <mf@go-sys.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 7443e881f8)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-07-17 13:17:37 +02:00
Tim Soubry
9e870099fa package/ncmpc: Fix build error with gcc-14
The error appears on autobuilder with the build using GCC14:
FAILED: ncmpc.p/src_Styles.cxx.o
In file included from ../src/Styles.cxx:7:
/home/buildroot/instance-0/output-1/host/microblazeel-buildroot-linux-gnu/sysroot/usr/include/libintl.h:39:14: error: expected unqualified-id before 'const'
   39 | extern char *gettext (const char *__msgid)
      |              ^~~~~~~
/home/buildroot/instance-0/output-1/host/microblazeel-buildroot-linux-gnu/sysroot/usr/include/libintl.h:39:14: error: expected ')' before 'const'
../src/i18n.h:22:20: note: to match this '('
   22 | #define gettext(x) (x)
      |                    ^
[80/102] Compiling C++ object ncmpc.p/src_xterm_title.cxx.o
[81/102] Compiling C++ object ncmpc.p/src_db_completion.cxx.o
[82/102] Compiling C++ object ncmpc.p/src_signals.cxx.o
ninja: build stopped: subcommand failed.
make: *** [package/pkg-generic.mk:273: /home/buildroot/instance-0/output-1/build/ncmpc-0.49/.stamp_built] Error 1
make: Leaving directory '/home/buildroot/instance-0/buildroot'

Starting GCC14 the C++ standard library includes libintl.h that contains
a definition of gettext which caused a clash with the definition present
in ncmpc. This patch resolved this build error seen in [1] by
backporting an upstream commit [2] that renamed the internal gettext
implementation.

Applying the commits of [2], fixes the build error [1].

[1] https://autobuild.buildroot.org/results/cb2/cb292f2c99cdca742a8f52dbfc25f193fe513c6e/build-end.log
[2] 249b62fc9f

Fixes: https://autobuild.buildroot.org/results/cb2/cb292f2c99cdca742a8f52dbfc25f193fe513c6e/build-end.log
Signed-off-by: Tim Soubry <tim.soubry@mind.be>
[Julien:
 - mention gcc-14 in commit title
 - remove patch numbering to fix check-package error
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit a52269e221)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-07-17 13:17:31 +02:00