Bernd Kuhls
84d5e144d7
package/intel-mediadriver: bump version to 26.1.5
...
https://github.com/intel/media-driver/releases/tag/intel-media-26.1.5
Signed-off-by: Bernd Kuhls <bernd@kuhls.net >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-03-27 21:54:11 +01:00
Bernd Kuhls
70e794a3dd
package/jpeg-turbo: bump version to 3.1.4
...
https://github.com/libjpeg-turbo/libjpeg-turbo/blob/3.1.4/ChangeLog.md
Updated license hash due to copyright year bump:
e9b497016ce82016c6bfbernd@kuhls.net >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-03-27 21:50:23 +01:00
Bernd Kuhls
729125a67f
{linux, linux-headers}: bump 6.{1, 6, 12, 18, 19}.x series
...
Signed-off-by: Bernd Kuhls <bernd@kuhls.net >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-03-27 21:39:48 +01:00
Bernd Kuhls
422c1af1cd
package/llvm-project: bump version to 22.1.2
...
https://discourse.llvm.org/t/llvm-22-1-2-released/90308
Signed-off-by: Bernd Kuhls <bernd@kuhls.net >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-03-27 21:34:54 +01:00
Bernd Kuhls
2c183f8b72
package/ccache: bump version to 4.13.2
...
https://ccache.dev/releasenotes.html#_ccache_4_13_2
Signed-off-by: Bernd Kuhls <bernd@kuhls.net >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-03-27 21:21:02 +01:00
Shubham Chakraborty
6bac6a1a63
DEVELOPERS: add Shubham Chakraborty as ccache maintainer
...
Signed-off-by: Shubham Chakraborty <chakrabortyshubham66@gmail.com >
[Julien: add trailing slash]
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-03-27 21:20:52 +01:00
Peter Korsgaard
6e4a136363
package/rauc: security bump to version 1.15.2
...
Fixes the following security issue:
CVE-2026-34155: Improper Signing of Plain Bundles Exceeding 2 GiB
RAUC bundles using the 'plain' format exceeding a payload size of 2 GiB
cause an integer overflow which results in a signature which covers only the
first few bytes of the payload. Given such a bundle with a legitimate
signature, an attacker can modify the part of the payload which is not
covered by the signature.
Bundles using the recommended 'verity' or 'crypt' formats are not affected.
For more details, see the advisory:
https://github.com/rauc/rauc/security/advisories/GHSA-6hj7-q844-m2hx
https://github.com/rauc/rauc/releases/tag/v1.15.2
Signed-off-by: Peter Korsgaard <peter@korsgaard.com >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-03-27 19:58:25 +01:00
Bernd Kuhls
22e4440eae
package/libpng: security bump to version 1.6.56
...
Fixes the following security vulnerabilities:
CVE-2026-33416 (high):
Use-after-free via pointer aliasing in `png_set_tRNS` and `png_set_PLTE`.
CVE-2026-33636 (high):
Out-of-bounds read/write in the palette expansion on ARM Neon.
For more details, see the advisories:
https://github.com/pnggroup/libpng/security/advisories/GHSA-m4pc-p4q3-4c7j
https://github.com/pnggroup/libpng/security/advisories/GHSA-wjr5-c57x-95m2
Release notes:
https://github.com/pnggroup/libpng/blob/v1.6.56/ANNOUNCE
Signed-off-by: Bernd Kuhls <bernd@kuhls.net >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-03-27 19:52:39 +01:00
Bernd Kuhls
ef01d4fc78
package/{glibc, localedef}: security bump to version 2.43-17-gdd9945c0b
...
Fixes CVE-2026-4437:
https://sourceware.org/git/?p=glibc.git;a=commit;h=5c6fca0c62ce5bd6e68e259f138097756cbafd4d
Fixes CVE-2026-4438:
https://sourceware.org/git/?p=glibc.git;a=commit;h=dd9945c0ba40d2dbc9eb7c99291ba6b69bd66718
For a full list of changes, see:
https://sourceware.org/git/?p=glibc.git;a=shortlog;h=dd9945c0ba40d2dbc9eb7c99291ba6b69bd66718
Signed-off-by: Bernd Kuhls <bernd@kuhls.net >
[Julien: add CVE-2026-443{7,8} to GLIBC_IGNORE_CVES]
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-03-27 19:47:20 +01:00
Bernd Kuhls
a9a4d0a7a5
package/freetype: security bump version to 2.14.3
...
https://sourceforge.net/projects/freetype/files/freetype2/2.14.3/
"- A bunch of potential security problems have been found. All users
should update."
Signed-off-by: Bernd Kuhls <bernd@kuhls.net >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-03-27 19:23:53 +01:00
Bernd Kuhls
f359f665be
package/tor: security bump version to 0.4.9.6
...
https://gitlab.torproject.org/tpo/core/tor/-/blob/tor-0.4.9.6/ReleaseNotes
Fixes TROVE-2026-003 & TROVE-2026-004. See:
https://gitlab.torproject.org/tpo/core/team/-/wikis/NetworkTeam/TROVE
Signed-off-by: Bernd Kuhls <bernd@kuhls.net >
[Julien: add link to TROVE page]
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-03-27 19:19:40 +01:00
Titouan Christophe
0ce674c244
SECURITY.md: add new file
...
This is an in-tree description of Buildroot's security policies
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-03-26 21:07:00 +01:00
Titouan Christophe
a667cbe134
docs/website: add security contact information on the homepage
...
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-03-26 21:07:00 +01:00
Thomas Perale
4749b83e59
website/sponsors.html: add IPComm as a silver sponsor
...
IPCOMM GmbH is a German company that develop industrial gateways and
inter-network communication solutions.
They agreed to sponsor the LTS maintenance for 2026. We thanks them for
their contribution.
- https://www.ipcomm.de/
- https://www.ipcomm.de/article/AboutUs/en/sheet.html
For more informations about the LTS sponsorship, see:
- https://buildroot.org/lts.html
Signed-off-by: Thomas Perale <thomas.perale@mind.be >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-03-26 20:36:06 +01:00
Thomas Perale
aef30aadfc
website/sponsors.html: use higher resolution img
...
Signed-off-by: Thomas Perale <thomas.perale@mind.be >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-03-26 20:36:06 +01:00
Thomas Perale
b20972e0df
website/sponsors.html: move sense to past sponsor
...
Sense is no longer sponsoring LTS for the year 2026.
Signed-off-by: Thomas Perale <thomas.perale@mind.be >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-03-26 20:36:06 +01:00
Thomas Perale
1a2037d2b8
website/sponsors.html: use flexbox for sponsor grid
...
To avoid having to move all the sponsors through the bootstrap 'row'
when adding a new "past sponsor" on top of the current stack, this
commit make the card rely on flexboxes instead of the bootstrap
internals.
This make sure that the body of the card always fit the row height and
the also make sure that the image always fit properly without having to
touch the inline css.
Signed-off-by: Thomas Perale <thomas.perale@mind.be >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-03-26 20:36:06 +01:00
Giulio Benetti
35e86cef16
package/libnss: bump version to 3.122
...
For release note, see:
https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_122.html
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-03-25 21:25:28 +01:00
Julien Olivain
9d29863c5e
support/testing: ndctl: new runtime test
...
Cc: Chen Pei <cp0613@linux.alibaba.com >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-03-25 21:12:20 +01:00
Giulio Benetti
0fa55218f4
package/bind: security bump to version 9.18.47
...
Release notes:
https://ftp.isc.org/isc/bind9/9.18.47/doc/arm/html/notes.html
Changelog:
https://ftp.isc.org/isc/bind9/9.18.47/doc/arm/html/changelog.html
Fixes CVE-2026-1519.
Fixes bug:
GL #5708
https://gitlab.isc.org/isc-projects/bind9/-/issues/5708
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-03-25 21:04:07 +01:00
Mattias Walström
7d26ff6c14
package/nghttp2: security bump to 1.68.1
...
For changelog, see:
https://github.com/nghttp2/nghttp2/releases/tag/v1.68.1
Fixes:
CVE-2026-27135:
nghttp2 Denial of service: Assertion failure due to the missing
state validation:
https://www.cve.org/CVERecord?id=CVE-2026-27135
Signed-off-by: Mattias Walström <lazzer@gmail.com >
[Julien: add links to changelog and CVE]
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-03-25 20:56:21 +01:00
Thomas Perale
50eca46e35
website/lts: fix typos
...
Signed-off-by: Thomas Perale <thomas.perale@mind.be >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-03-24 22:14:51 +01:00
Thomas Perale
e28b94d008
website/lts: add pre-filled content to mailto
...
Clicking on the mailto tag will prefill the email with the following
content:
> Thanks for showing interest in the Buildroot LTS Sponsorship. We would
> appreciate if you could introduce yourself and your company by
> answering the following questions: in which products do you use
> Buildroot ? How are you using Buildroot ? How many different
> configurations do you have ? How long do you support your products ?
Signed-off-by: Thomas Perale <thomas.perale@mind.be >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-03-24 22:14:51 +01:00
Thomas Perale
e656b8b639
website/lts: fix section on small screens
...
Make the section header take the whole screen size for device with a
small screen (mobile phones).
Signed-off-by: Thomas Perale <thomas.perale@mind.be >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-03-24 22:14:51 +01:00
Thomas Perale
b4889d8b1c
website/lts: remove the href on section
...
We have received report from people about the section pointer that makes
them want to click on the "Sponsor Now !" section.
The original idea was to be able to link sub-section but let's make this
section is not clickable instead.
Signed-off-by: Thomas Perale <thomas.perale@mind.be >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-03-24 22:14:51 +01:00
Vincent Stehlé
d18f7e0916
boot/edk2: fix build with host gcc >= 15, glibc >= 2.43
...
The edk2 package fails to build with gcc 15, with the following error:
EfiRom.c:78:17: error: assignment discards 'const' qualifier from pointer target type [-Werror=discarded-qualifiers]
Cherry-pick one patch from edk2-stable202602 to fix this.
This can be verified with the tests.boot.test_edk2 python tests.
Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com >
Cc: Dick Olsson <hi@senzilla.io >
[Julien: add "host" gcc 15 and glibc 2.43 in commit title]
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-03-24 21:57:56 +01:00
Manuel Diener
c8dd9e9a01
package/python-django: security bump to 6.0.3
...
Fixes the following security issues:
CVE-2026-25673 (moderate):
Potential denial-of-service vulnerability in URLField via Unicode
normalization on Windows
https://www.cve.org/CVERecord?id=CVE-2026-25673
CVE-2026-25674 (low): Potential incorrect permissions on newly
created file system objects
https://www.cve.org/CVERecord?id=CVE-2026-25674
See the release notes here:
https://docs.djangoproject.com/en/6.0/releases/6.0.3/
This commit also fixes the license hash file
django/contrib/gis/measure.py, after whitespace cleanup:
090f1da56e (diff-eb11d321d233226d88aeffc485fb6c318a06e807feb1574d80a92a7d6a1461a2)manuel.diener@oss.othermo.de >
[Julien: fix license hash for django/contrib/gis/measure.py]
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-03-24 12:11:14 +01:00
Flaviu Nistor
1332aaade4
package/python-smmap2: bump to version 5.0.3
...
For release notes, see:
https://github.com/gitpython-developers/smmap/releases/tag/v5.0.3
Signed-off-by: Flaviu Nistor <flaviu.nistor@gmail.com >
[Julien: add link to release notes]
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-03-23 21:34:54 +01:00
Giulio Benetti
e8a567043d
package/libnss: bump version to 3.121
...
For release note, see:
https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_121.html
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-03-23 21:29:08 +01:00
Giulio Benetti
dd75f2f6a0
package/libfuse3: bump to version 3.18.2
...
Release notes:
https://github.com/libfuse/libfuse/releases/tag/fuse-3.18.2
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-03-23 21:22:32 +01:00
Bernd Kuhls
cf9a58b042
package/openblas: fix build
...
Buildroot commit b08ac7636dhttps://github.com/OpenMathLib/OpenBLAS/issues/5607
was introduced by upstream commit
879497990fhttps://autobuild.buildroot.net/results/7d8/7d80a912ddda01acd109786641df02ad826399f6/
Signed-off-by: Bernd Kuhls <bernd@kuhls.net >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-03-23 21:16:04 +01:00
Waldemar Brodkorb
8937414d68
package/ruby: bump to 4.0.2
...
See here for news in the release:
https://www.ruby-lang.org/en/news/2026/03/16/ruby-4-0-2-released/
Signed-off-by: Waldemar Brodkorb <wbx@openadk.org >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-03-23 21:01:57 +01:00
Waldemar Brodkorb
83386ecb9c
DEVELOPERS: remove Waldemar Brodkorb from zabbix
...
I am no longer interested in zabbix.
Signed-off-by: Waldemar Brodkorb <wbx@openadk.org >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-03-23 21:00:46 +01:00
Waldemar Brodkorb
84ece21e84
package/asterisk: security bump to 22.8.2
...
See here for detailed changelog:
https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-22.8.2.html
Fixes the following CVEs:
CVE-2026-23739 / GHSA-85x7-54wr-vh42:
Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential
XXE Injection
https://github.com/asterisk/asterisk/security/advisories/GHSA-85x7-54wr-vh42
https://www.cve.org/CVERecord?id=CVE-2026-23739
CVE-2026-23741 / GHSA-rvch-3jmx-3jf3:
ast_coredumper running as root sources ast_debug_tools.conf from
/etc/asterisk; potentially leading to privilege escalation
https://github.com/asterisk/asterisk/security/advisories/GHSA-rvch-3jmx-3jf3
https://www.cve.org/CVERecord?id=CVE-2026-23741
CVE-2026-23738 / GHSA-v6hp-wh3r-cwxh:
The Asterisk embedded web server's /httpstatus page echos user
supplied values(cookie and query string) without sanitization
https://github.com/asterisk/asterisk/security/advisories/GHSA-v6hp-wh3r-cwxh
https://www.cve.org/CVERecord?id=CVE-2026-23738
CVE-2026-23740 / GHSA-xpc6-x892-v83c:
ast_coredumper runs as root, and writes gdb init file to world
writeable folder; leading to potential privilege escalation
https://github.com/asterisk/asterisk/security/advisories/GHSA-xpc6-x892-v83c
https://www.cve.org/CVERecord?id=CVE-2026-23740
Signed-off-by: Waldemar Brodkorb <wbx@openadk.org >
[Julien: add CVE details in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-03-23 20:51:38 +01:00
Vincent Cruz
20c3eb6eb6
package/libwebsockets: bump version to 4.5.7
...
Changelog:
https://github.com/warmcat/libwebsockets/blob/v4.5.7/changelog
Signed-off-by: Vincent Cruz <mooz@blockos.org >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-03-23 20:26:56 +01:00
Alexander Shirokov
8b3d346bd4
package/broot: bump to version 1.56.1
...
Changelog: https://github.com/Canop/broot/blob/v1.56.1/CHANGELOG.md
Signed-off-by: Alexander Shirokov <shirokovalexs@gmail.com >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-03-22 15:20:15 +01:00
Giulio Benetti
170b59b4fb
package/dash: bump to version 0.5.13.2
...
For change log, see:
https://git.kernel.org/pub/scm/utils/dash/dash.git/log/?h=b308564a1ff6530f9fd3e7dd7b19aabae32ed375
Let's also drop useless comment in hash file.
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-03-22 15:11:31 +01:00
Bernd Kuhls
fe4b420630
package/piglit: bump version to git ec0fc2fef0
...
Includes
ec0fc2fef0bernd@kuhls.net >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-03-22 14:35:45 +01:00
Bernd Kuhls
f9c20750e2
package/dtbocfg: bump version to 0.1.1
...
https://github.com/ikwzm/dtbocfg/compare/v0.1.0...v0.1.1
Signed-off-by: Bernd Kuhls <bernd@kuhls.net >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-03-22 13:04:07 +01:00
Bernd Kuhls
abb44c520b
package/dropwatch: bump version to 1.5.5
...
https://github.com/nhorman/dropwatch/releases/tag/v1.5.5
Signed-off-by: Bernd Kuhls <bernd@kuhls.net >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-03-22 12:36:42 +01:00
Bernd Kuhls
9c66b7ece1
package/dvblast: bump version to 3.5
...
https://code.videolan.org/videolan/dvblast/-/blob/3.5/NEWS
Depends on bitstream >= 1.6.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-03-22 12:28:37 +01:00
Bernd Kuhls
86254ee6b5
package/bitstream: bump version to 1.6
...
https://code.videolan.org/videolan/bitstream/-/blob/1.6/NEWS
Signed-off-by: Bernd Kuhls <bernd@kuhls.net >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-03-22 12:28:37 +01:00
Bernd Kuhls
72711087f2
package/kodi-pvr-zattoo: bump version to 21.0.6-Omega
...
https://github.com/rbuehlma/pvr.zattoo/releases/tag/21.0.6-Omega
Signed-off-by: Bernd Kuhls <bernd@kuhls.net >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-03-22 12:26:01 +01:00
Bernd Kuhls
2942fd8079
package/intel-vpl-gpu-rt: bump version to 26.1.4
...
https://github.com/intel/vpl-gpu-rt/releases/tag/intel-onevpl-26.1.4
Signed-off-by: Bernd Kuhls <bernd@kuhls.net >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-03-22 11:57:49 +01:00
Bernd Kuhls
9ed1ffa10c
package/intel-mediadriver: bump version to 26.1.4
...
https://github.com/intel/media-driver/releases/tag/intel-media-26.1.4
Signed-off-by: Bernd Kuhls <bernd@kuhls.net >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-03-22 11:57:49 +01:00
Andreas Ziegler
83e637d7cc
package/mpd: add missing optional dependency
...
Config.in selects libiconv in certain situations (uClibc with locales
not enabled). This may lead to a build error with utils/test-pkg -p mpd.
Add missing optional dependency and restore sorting order.
Signed-off-by: Andreas Ziegler <br025@umbiko.net >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-03-21 22:59:21 +01:00
Andreas Ziegler
e7e2050d54
package/mpd: disable build of manuals
...
The documentation feature was introduced with version 0.22, but is not
used. Instead two other options (also introduced with 0.22) control
building HTML manual and man pages. If the tools needed are not found,
the documentation build finishes silently.
Save Meson some effort by setting both options to 'false'.
Signed-off-by: Andreas Ziegler <br025@umbiko.net >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-03-21 22:59:21 +01:00
Andreas Ziegler
ee324c5bab
package/mpd: enforce tcp for options using http
...
Prevent disabling of TCP if some option is selected that uses HTTP.
Fixes:
https://autobuild.buildroot.org/results/59b0be79b1ca1469477e7634205f3eaaebef7d5f
Signed-off-by: Andreas Ziegler <br025@umbiko.net >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-03-21 22:59:21 +01:00
Bernd Kuhls
98d42291fc
package/gerbera: bump version to 3.2.0
...
https://github.com/gerbera/gerbera/blob/v3.2.0/ReleaseNotes.md
Removed patch which is included in this release.
Added optional dependency to libpqxx which needs to be built with CMake.
Added optional dependency to new libzippp package.
Added cxxopts as new dependency:
72f7655e86bernd@kuhls.net >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-03-21 21:23:53 +01:00
Bernd Kuhls
4f5f360350
package/libpqxx: switch to CMake
...
The upcoming version bump of gerbera includes optional PostgreSQL
support using libpqxx which will only be detected if libpqxx was built
with CMake:
Quoting the error message with libpqxx being built with autoconf:
CMake Error at CMakeLists.txt:685 (find_package):
By not providing "Findlibpqxx.cmake" in CMAKE_MODULE_PATH this project has
asked CMake to find a package configuration file provided by "libpqxx", but
CMake did not find one.
Could not find a package configuration file provided by "libpqxx" with any
of the following names:
libpqxxConfig.cmake
libpqxx-config.cmake
Add the installation prefix of "libpqxx" to CMAKE_PREFIX_PATH or set
"libpqxx_DIR" to a directory containing one of the above files. If
"libpqxx" provides a separate development package or SDK, be sure it has
been installed.
usr/lib/pkgconfig/libpqxx.pc is still provided by the CMake build system.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-03-21 21:23:53 +01:00
