Commit Graph

79988 Commits

Author SHA1 Message Date
Thomas Devoogdt
95ba97009c package/webkitgtk: security bump to version 2.50.4
News:
 - https://webkitgtk.org/2025/11/19/webkitgtk2.50.2-released.html
 - https://webkitgtk.org/2025/12/04/webkitgtk2.50.3-released.html
 - https://webkitgtk.org/2025/12/16/webkitgtk2.50.4-released.html

Security advisory:
 - https://webkitgtk.org/security/WSA-2025-0008.html
 - https://webkitgtk.org/security/WSA-2025-0009.html
 - https://webkitgtk.org/security/WSA-2025-0010.html

Signed-off-by: Thomas Devoogdt <thomas@devoogdt.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 39d8525ede)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-02-13 20:33:41 +01:00
Thomas Devoogdt
38021502fb package/mesa3d: fix host-mesa3d compilation with latest llvm installed on the host
On Buildroot 2025.05.3, Meson's custom LLVM parser uses llvm-config
with a default search path of /usr/bin, causing it to detect the host
system's llvm-config (version 18.1.3) instead of the buildroot-compiled
one. This forces all LLVM-related packages to match version 18.1.3, but
since the host system lacks llvmspirvlib, the build fails. This patch
forces Meson to use the buildroot-compiled llvm-config.

On the master branch, the meson is somehow able to find the right
llvm-config, so reproduction only seems to be possible if the host
machine ships with a newer version as the one buildroot is using.

  llvm-config found: YES
  ([...]/output/host/bin/llvm-config)
  21.1.8
  Run-time dependency LLVM (modules: bitwriter, core, coverage, engine,
  executionengine, instcombine, irreader, libdriver, linker, lto,
  mcdisassembler, mcjit, native, option, scalaropts, target,
  transformutils, all-targets, coroutines, frontenddriver, frontendhlsl,
  lto, windowsdriver) found: YES 21.1.8

Note that LLVM_CONFIG is a CMake option, not a Meson one. This is because
Meson has custom dependency resolution logic for LLVM (see
https://mesonbuild.com/Dependencies.html#llvm). The EXTRA_BINARIES mechanism
cannot be used here, as it only applies to cross-compilation scenarios, which
does not apply to host-mesa3d builds.

Reproduction (On BR2 tag: 2025.05.3):

BR2_x86_64=y
BR2_x86_atom=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_X86_64_GLIBC_STABLE=y
BR2_LINUX_KERNEL=y
BR2_LINUX_KERNEL_CUSTOM_VERSION=y
BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.1.24"
BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="board/pc/linux.config"
BR2_LINUX_KERNEL_INSTALL_TARGET=y
BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y
BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
BR2_PACKAGE_MESA3D=y
BR2_PACKAGE_MESA3D_LLVM=y
BR2_PACKAGE_MESA3D_GALLIUM_DRIVER_I915=y
BR2_PACKAGE_MESA3D_GALLIUM_DRIVER_IRIS=y
BR2_PACKAGE_MESA3D_OPENGL_EGL=y
BR2_PACKAGE_MESA3D_OPENGL_ES=y

Fixes:

  llvm-config found: YES (/usr/bin/llvm-config-18) 18.1.3
  Run-time dependency LLVM (modules: bitwriter, core, coverage, engine, executionengine, instcombine, irreader, libdriver, linker, lto, mcdisassembler, mcjit, native, option, scalaropts, target, transformutils, all-targets, coroutines, frontenddriver, frontendhlsl, lto, windowsdriver) found: YES 18.1.3
  Dependency LLVMSPIRVLib found: NO. Found 15.0.0.0 but need: '>= 18.1' ; matched: '>= 15.0.0.0', '< 18.2'
  Run-time dependency llvmspirvlib found: NO (tried cmake)

  output/build/host-mesa3d-25.0.6/meson.build:1882:21: ERROR: Dependency lookup for LLVMSPIRVLib with method 'pkgconfig' failed: Invalid version, need 'LLVMSPIRVLib' ['>= 18.1'] found '15.0.0.0'.

Signed-off-by: Thomas Devoogdt <thomas.devoogdt@barco.com>
[Romain:
  - Update the commit title
  - Update commit log about this issue on master branch
  https://lore.kernel.org/buildroot/CACXRmJh1-5Cy92kF9TM5nDs_uB90WAe5iOGmNNL2E-cMhJE7GA@mail.gmail.com/
]
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit eb0e63888b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-02-13 20:33:39 +01:00
Raphaël Mélotte
d2ada422c0 package/mupdf: update release hashes comment
The old URL now leads to an HTTP 404 not found error.
Update it to the new one which contains the hashes for the current
release as well as older ones.

Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit 6fed872e08)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-02-13 20:33:37 +01:00
Raphaël Mélotte
da48583a93 package/mupdf: skip installing docs to the target
The current 'install' target comprises 'install-libs', 'install-apps'
and 'install-docs'.

In our case we don't want to install documentation to the target, so
just run the other two.

Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit ba48197d1f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-02-13 20:33:35 +01:00
Thomas Petazzoni
53f8d285f6 package/uclibc: also install utils to STAGING_DIR
When BR2_UCLIBC_INSTALL_UTILS is enabled, utils such as getconf, ldd,
locale get installed to TARGET_DIR. However, they do not get installed
to STAGING_DIR, which is annoying as it means that they are not part
of external toolchains built by Buildroot.

This commit adjusts the uclibc package to make sure those tools also
get installed to STAGING_DIR.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 272d281ba9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-02-13 20:33:32 +01:00
Thomas Petazzoni
0c963c5d31 package/uclibc: rename UCLIBC_INSTALL_UTILS_STAGING to UCLIBC_INSTALL_HOST_UTILS
The UCLIBC_INSTALL_UTILS_STAGING is really badly named, as it doesn't
install anything to STAGING_DIR. Instead, it installs the host variant
of ldd and ldconfig into $(HOST_DIR)/bin. Therefore, rename it to
UCLIBC_INSTALL_HOST_UTILS.

This is important as a follow-up commit will re-introduce a
UCLIBC_INSTALL_UTILS_STAGING variable which really installs things
into STAGING_DIR.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 026c635508)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-02-13 20:33:31 +01:00
Bernd Kuhls
6cb462204c package/squeezelite: fix build with gcc >= 15.x
No autobuilder errors recorded yet.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 944b0ef086)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-02-13 20:33:28 +01:00
Thomas Petazzoni
2701ece1ce package/dvdrw-tools: remove package
Upstream is dead, website unreachable, and the use case in 2026 is
dubious, so drop the package.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 95519e0464)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-02-13 20:33:26 +01:00
Alex Bennée
7f44219be5 package/kvm-unit-tests: assume AArch64 supports KVM
Although it is possible to configure an AArch64 CPU without support
for EL2 in practice all the common AArch64 have supported
virtualisation from the start.

If we really wanted to be strict we could blacklist known non-EL2 CPUs
but AFAICT all the current ones in the config have EL2.

I should also note KVM on Arm is deprecated and was removed from the
kernel in v6.10.

Reviewed-by: Jesse Taube <jesse@rivosinc.com>
Reviewed-by: Thomas Huth <huth@tuxfamily.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 137d6e249d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-02-13 20:33:24 +01:00
Waldemar Brodkorb
40f4ef8d49 package/asterisk: add workaround to fix build issues
Sometimes asterisk buildsystem decides to remove our own
build menuselect stuff for the host. And then fails to
run the cross-compiled binary.

Add a patch to avoid removal of the menuselect stuff.

Fixes:
 - https://autobuild.buildroot.net/results/5f7/5f76f032ee596e928089b064b01f08adacade47a/

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit e4e71c6c83)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-02-13 20:33:22 +01:00
Bart Van Severen
6e0eb8753a package/libwebsockets: fix LWS_MAX_SMP when BR2_TOOLCHAIN_HAS_THREADS is set
The .mk file currently states:

   If LWS_MAX_SMP=1, then there is no code related to pthreads
   compiled in the library. If unset, LWS_MAX_SMP defaults to 32 and a
   small amount of pthread mutex code is built into the library.

However, this is incorrect: when unset, LWS_MAX_SMP is actually set to
1, so mutexes aren't built in.

To fix, set it to 32 explicitly when threads are enabled. Why 32?
Because
https://libwebsockets.org/lws-api-doc-master/html/md_README.coding.html
states:

   You can control the context basic data allocation for
   multithreading from Cmake using -DLWS_MAX_SMP=, if not given it's
   set to 32.

Signed-off-by: Bart Van Severen <bart.vanseveren@barco.com>
Signed-off-by: Thomas Devoogdt <thomas.devoogdt@barco.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit b3abf16c8e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-02-13 20:33:20 +01:00
Bernd Kuhls
6221f87c17 package/brltty: fix musl build
Fixes:
https://autobuild.buildroot.net/results/76d/76d18437241d1281566b76ed1cec2ba99c3532da/

The build error was not introduced by the recent bump to 6.8. The oldest
build error with the previous brltty version 6.6 used in buildroot dates
back to 2023:
https://autobuild.buildroot.net/results/78a/78a7fe6edfb84c2b15fff32aa475c975ecd5bdbc/

and with brltty 6.4 to 2022:
https://autobuild.buildroot.net/results/a5b/a5b338ce9865fc7afaecd9b671e6a8f290548374/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 06eacc370d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-02-13 20:33:18 +01:00
Bernd Kuhls
fd0ea11ac4 package/brotli: fix LoongArch64 build
Buildroot commit 473c9400a0 bumped brotli
to version 1.2.0 causing build errors on loongarch64. The build error
does not occur with brotli 1.1.0.

Fixes:
https://autobuild.buildroot.net/results/57f/57f61a5fd17432bba05e4f1865f82cc2f4626d3c/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 302a325f1f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-02-13 20:33:16 +01:00
Lance Fredrickson
66dcc3e2a9 package/libcurl: also specify the CA bundle location
When given a certificate directory with --with-ca-path, curl doesn't
list the files in that directory. Instead, it uses the certificate hash
to directly open the requested CA certificate. Therefore, putting a
bundle in that directory and removing all the individual certificates is
not possible.

In order to support use of the bundle, a separate configuration option
--with-ca-bundle is needed. With this option, it is possible to remove
the individual certificates and include just the bundle, which reduces
the size of the root filesystem a bit.

Note that the bundle is generated by the ca-certificates package, which
also installs the individual certificates and the hash symlinks. It
keeps both individual certificates and the bundle in the target.

Signed-off-by: Lance Fredrickson <lancethepants@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 5a63ee3c09)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-02-13 20:33:14 +01:00
Waldemar Brodkorb
581091f89e package/strongswan: add patch to fix CVE-2025-62291
https://nvd.nist.gov/vuln/detail/CVE-2025-62291

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
[Marcus: add comment pointing to patch before _IGNORE_CVES]
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit b009935e27)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-02-13 20:33:12 +01:00
Joachim Wiberg
d818534f41 package/libite: bump to v2.6.2
Changes:
- Fix memory leak in which() on realloc() failure
- Fix pidfile() to handle missing trailing slash in prefix path

Changes to src/pidfile.c do not affect the licensing terms, but
require updating the hash of this file that is used as one of the
license files.

https://github.com/troglobit/libite/releases/tag/v2.6.2

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 8e7a54f7ef)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-02-13 20:33:10 +01:00
Joachim Wiberg
3a32f60753 package/libite: add dependency on MMU, requires fork()
Unfortunately, parts of the library is not very no-MMU friendly atm.
The below check fails due to runbg.c requiring fork().

$ ./utils/test-pkg -c libite.config -p libite
                    bootlin-armv5-uclibc [1/6]: OK
                     bootlin-armv7-glibc [2/6]: OK
                   bootlin-armv7m-uclibc [3/6]: FAILED
                     bootlin-x86-64-musl [4/6]: OK
                      br-arm-full-static [5/6]: OK
                             arm-aarch64 [6/6]: OK

The dependency was introduced in libite v2.6.0, so this patch should
be backported to v2025.02.x.

Fixes:

 https://autobuild.buildroot.net/results/6c6fd2ae410a82c44da54ee13a09a38a7ab220c1/

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit e0b129e36e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-02-13 20:33:08 +01:00
Thomas Petazzoni
5fb22b1ee2 package/libbsd: fix build with uClibc
Since the bump of libbsd from 0.11.7 to 0.12.2 in Buildroot commit
c555b6565f, the build of libbsd was
broken on uClibc, due to changes in libbsd.

In order to fix this, we add a patch (submitted upstream), which is
based on a suggestion from libbsd's maintainer, itself based on an
initial proposal from Dario Binacchi.

Fixes:

  https://autobuild.buildroot.net/results/384022450a09b7d731e3817c812e30e15187344b/

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit c0fd48dc26)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-02-13 20:33:06 +01:00
Bernd Kuhls
84d7d2c3ac package/screen: fix usage with readonly rootfs
Buildroot commit 4769724ee2 bumped the
package from 4.9.1 to 5.0.0 which includes a major rewrite of the
configure script
https://cgit.git.savannah.gnu.org/cgit/screen.git/log/src/configure.ac?h=v.4.9.1
https://cgit.git.savannah.gnu.org/cgit/screen.git/log/src/configure.ac?h=v.5.0.0

By default, screen puts the socket directory in $HOME/.screen, which
is not writable when the rootfs is readonly:

 # screen
 Cannot access /root/.screen: No such file or directory

The --enable-socket-dir option added in upstream commit
https://cgit.git.savannah.gnu.org/cgit/screen.git/commit/?id=78a961188f7da528c7cefcc63e07f35f04e69a93
allows to configure this, and actually its default value of
/run/screen is sensible, so we fix the problem by simply passing
--enable-socket-dir, and rely on its default setting.

Fixes:

  https://gitlab.com/buildroot.org/buildroot/-/issues/123

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 21311f79c6)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-02-13 20:33:04 +01:00
Kadambini Nema
efa9144d57 support/scripts/pkg-stats: add -N/--needs-update option
This commit adds the -N/--needs-update option, disabled by default,
to list only packages with newer upstream versions. All other packages
will be excluded from the HTML or JSON output.

Signed-off-by: Kadambini Nema <kadambini.nema@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit ed9466e7f9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-02-13 20:33:02 +01:00
Giulio Benetti
ba56a26342 package/bind: security bump version to 9.18.44
Release notes:
https://ftp.isc.org/isc/bind9/9.18.44/doc/arm/html/notes.html

Changelog:
https://ftp.isc.org/isc/bind9/9.18.44/doc/arm/html/changelog.html

Fixes CVE-2025-13878.

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit fbad192a4d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-02-13 20:33:00 +01:00
Bernd Kuhls
d2882b9acd package/libopenssl: fix powerpc64 build
Buildroot commit f710640be5 bumped the
package to version 3.6.0 that includes upstream commit
8f24a148e6
which causes build errors on powerpc64.

The upstream commit was also backported to older libopenssl branches:
https://github.com/openssl/openssl/pull/28990#issuecomment-3675219918
but its first appearance on the buildroot master branch was with said
bump to 3.6.0.

This patch adds an upstream patch to fix the problem.

Fixes:
https://autobuild.buildroot.net/results/b28/b286ad40f2240a85b9cd0dc44e089d1d6babd3ea/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 96f01932be)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-02-13 20:32:58 +01:00
Florian Larysch
fcf5b59d61 support/misc/relocate-sdk.sh: pre-calculate files in need of relocation
Currently, the relocate-sdk.sh script scans the whole extracted SDK tree
to find instances of paths it needs to replace, which can take a
significant amount of time when the SDK is large, particularly relative
to the number of files that actually need to change.

However, the resulting list only depends on the SDK tarball itself, so
we can calculate it at build time and ship it with the tarball so
relocate-sdk.sh can use it directly.

Testing this on my machine with somewhat IOPS-limited rotating media,
the time goes down from:

$ time ./relocate-sdk.sh
Relocating the buildroot SDK from [...] to [...] ...
./relocate-sdk.sh  5.19s user 26.21s system 9% cpu 5:34.40 total

To:

$ time ./relocate-sdk.sh
Relocating the buildroot SDK from [...] to [...] ...
./relocate-sdk.sh  0.49s user 0.29s system 103% cpu 0.749 total

Signed-off-by: Florian Larysch <fl@n621.de>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 63877f9e86)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-02-13 20:32:56 +01:00
Bernd Kuhls
c2a4bdd8e1 package/mesa3d: fix aarch64_be build
Buildroot commit 1b8d7e7bed bumped the
package to version 23.2.1 that contains the upstream commit
77826e8352 (e65744354fdd7dd38342b138e59e40767cfcdaa9)
which causes build errors on aarch64_be.

The build error was first seen by the autobuilders with mesa3d-23.3.3:
https://autobuild.buildroot.net/results/b62/b62eba2155b080ed02fde774994f2fffc8a6ef51/
according to https://autobuild.buildroot.net/?reason=mesa3d-25.3.4&arch=aarch64_be

A backport to LTS branches should be considered.

Fixes:
https://autobuild.buildroot.net/results/efd/efd07d97df4e0c1ceb07fc26e17898afef5435b9/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Romain: update the link to autobuilders mesa3d & aarch64_be issues]
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit 32c6fffd41)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-02-13 20:32:54 +01:00
Julien Olivain
af208ccb89 package/glibc: add CVE-2025-15281 CVE-2026-0861 CVE-2026-0915 to _IGNORE_CVES
Commit [1] bumped glibc from 2.42-3-gbc13db739 to 2.42-51-gcbf39c26b
to fix some CVEs, but forgot to add those CVEs to GLIBC_IGNORE_CVES.
This was needed because the GLIBC_CPE_ID_VERSION used for CVE checks
remains to the same value "2.42" which is marked as vulnerable to
those CVEs.

This commit adds those _IGNORE_CVES with the corresponding upstream
commit references, to make sure they will not be reported by the
"make pkg-stats" command.

Fixes:
- [1]

[1] 18de297a5a

Cc: Waldemar Brodkorb <wbx@openadk.org>
Cc: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 574aa2cfee)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-02-12 15:06:56 +01:00
Julien Olivain
e5c010239b support/scripts/pkg-stats: fix RuntimeError with python 3.14 asyncio
When running "make pkg-stats" on a host with Python 3.14 (e.g.
Fedora 43 for example), the execution fails with the error:

    Checking URL status
    Traceback (most recent call last):
      File "/buildroot/support/scripts/pkg-stats", line 1387, in <module>
        __main__()
        ~~~~~~~~^^
      File "/buildroot/support/scripts/pkg-stats", line 1368, in __main__
        loop = asyncio.get_event_loop()
      File "/usr/lib64/python3.14/asyncio/events.py", line 715, in get_event_loop
        raise RuntimeError('There is no current event loop in thread %r.'
                           % threading.current_thread().name)
    RuntimeError: There is no current event loop in thread 'MainThread'.

This is due to a breaking change introduced in Python 3.14
asyncio.get_event_loop(). See [1]. Before Python 3.14, this call was
creating and setting an event loop if there was none. This situation
is now a runtime error.

In order to fix this issue with newer Python version, while keeping
backward compatibility, this commit replaces the code:

    loop = asyncio.get_event_loop()

by an explicit event loop creation:

    loop = asyncio.new_event_loop()
    asyncio.set_event_loop(loop)

This commit was tested on a Fedora 43 host with Python-3.14.2, and
with the Buildroot Docker image plus the python3-aiohttp package
which is a Debian 12 with Python-3.11.2.

[1] https://docs.python.org/3.14/library/asyncio-eventloop.html#asyncio.get_event_loop

Signed-off-by: Julien Olivain <ju.o@free.fr>
Tested-by: Vincent Fazio <vfazio@xes-inc.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit e9f426aa52)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-02-12 15:06:29 +01:00
Bernd Kuhls
d4db2cf370 package/php-lua: add comment for lua dependency
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Acked-by: Herve Codina <herve.codina@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 995196ea5a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-02-12 15:05:58 +01:00
Bernd Kuhls
cc3d9fa6ba package/spandsp: fix build with gcc >= 14.x
Added upstream patch to fix build error.
The build error does not occur with gcc-13.x.

The first build error of this kind was recorded 2024-08-23:
https://autobuild.buildroot.net/results/492/4927e93e40ec8bcda107f4bc3d8aa83024deb674/

Fixes:
https://autobuild.buildroot.net/results/48a/48af80bdda62ca70d73bc01e0939f548c3736c0d/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 130b5a124c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-02-12 15:05:37 +01:00
Julien Olivain
2a93146b3d package/util-linux: always disable man pages and translations
When the host system has asciidoctor and po4a/poman installed,
util-linux detect them and automatically enable manual pages and
their translations. This can significantly increase the package
build time (in my case, from 20s to 1m50s). See upstream
commit [1] and [2].

Since manual pages are not needed in Buildroot, this commit adds in
_CONF_OPTS for host host and target variants the options to always
disable the detection of those programs (--disable-asciidoc
--disable-poman). This will always disable the generation of manual
pages.

Note: Buildroot attempts to globally disable documentation for
autotools packages by passing various --disable-docs configure
options (see [3]), but those are not recognized by util-linux.

This commit also reorder the options for UTIL_LINUX_CONF_OPTS.

[1] 9acfc349e0
[2] 236421a491
[3] https://gitlab.com/buildroot.org/buildroot/-/blob/2025.11/package/pkg-autotools.mk#L184-186

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit dd81c1766e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-02-12 15:04:58 +01:00
Thomas Devoogdt
cec80fc067 package/mesa3d: explicitly enable llvm for host-mesa3d
LLVM is already implicitly enabled for host-mesa3d when
BR2_PACKAGE_MESA3D_NEEDS_PRECOMP_COMPILER is selected. This blind
option is automatically enabled when LLVM is required by drivers such
as intel-iris, panfrost, imagination, or intel-vulkan.

The BR2_PACKAGE_MESA3D_LLVM option also independently selects host-llvm,
but this change makes the dependency more explicit for host-mesa3d
builds.

Note that disabling LLVM is not possible for host-mesa3d, as the build
will fail with:
../../../br-test-pkg/bootlin-armv5-uclibc/build/host-mesa3d-25.3.2/meson.build:847:3: ERROR: Feature llvm cannot be disabled: CLC requires LLVM

Signed-off-by: Thomas Devoogdt <thomas@devoogdt.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit db1a28435d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-02-12 15:04:07 +01:00
Bernd Kuhls
b261c64113 package/parprouted: fix build with gcc >= 15.x
Fixes:

  https://autobuild.buildroot.net/results/572669fe1f9a77083a361fee7c8acdf38d7375ae/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit eb25a634c1)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-02-12 15:03:43 +01:00
Thomas Petazzoni
11067d8311 package/gpsd: fix CVE-2025-67268 and CVE-2025-67269
Backport two security fixes from upstream. They are in newer releases,
but to facilitate backporting to our LTS releases, this backports the
fixes.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit d41ed2ea54)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-02-12 15:02:48 +01:00
Thomas Perale
a4e1cd78d4 package/aardvark-dns: add CPE identifier
The cpe:2.3:a:containers:aardvark-dns:*:*:*:*:*:*:*:* is
valid for this package.

See https://nvd.nist.gov/products/cpe/detail/5F79D5CD-D716-4190-BE08-31EB5EEB233F

The CPE version strip the 'v' prefix from the version.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Reviewed-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 37152aa6c3)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-02-12 15:02:28 +01:00
Michael Nosthoff
65f79ccea2 package/bitcoin: drop dependencies on Boost Libraries
The dependencies on Boost.System, Boost.Filesystem were removed in
v23.0 [0][1] and Boost.Thread in v21.99 [2].

This was never reflected in the Buildroot package so do it now.

[0] 07269321f3
[1] b87f9c5edf
[2] 06e1d7d81d

Signed-off-by: Michael Nosthoff <buildroot@heine.tech>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 9171d2982b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-02-12 15:01:48 +01:00
Julien Olivain
b5812f25db package/efl: fix check-package error
Commit [1] added the "Upstream:" package patch tag, but forgot to
remove the corresponding .checkpackageignore entry.

This commit fixes that.

Fixes:

    package/efl/0001-ecore_fb-fix-build-with-tslib.patch:0: lib_patch.Upstream was expected to fail, did you fix the file and forget to update .checkpackageignore?

[1] bac34296bf

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit d30457efd0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-02-12 15:01:38 +01:00
Marcus Hoffmann
40d083cf24 support/testing: python-requests: new runtime test
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
[Peter: Fix flake8 warning, use http.server instead of relying on
        connectivity]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 425abcd025)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-02-12 15:01:09 +01:00
Thomas Perale
02eb833145 package/libucl: add CPE
The CPE `vstakhov:libucl` is a valid CPE for the package libucl.

See the latest CVE: CVE-2025-6499 [1] that reference the upstream
repository.

[1] https://nvd.nist.gov/vuln/detail/CVE-2025-6499

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit ef52933074)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-02-12 15:01:02 +01:00
Thomas Perale
03f10d4ec2 package/igmpproxy: add CPE
The CPE `pali:igmpproxy` is a valid CPE for the package igmpproxy.

See the latest CVE: CVE-2025-50681 [1] that reference the upstream
repository.

[1] https://nvd.nist.gov/vuln/detail/CVE-2025-50681

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 7ed80ecec1)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-02-12 15:00:54 +01:00
Thomas Perale
fa26dff91c package/easy-rsa: add CPE
The CPE `openvpn:easy-rsa` is valid for the EasyRsa package. The last
CVE is CVE-2024-13454 [1] that is reference in the upstream bug tracker
[2].

[1] https://nvd.nist.gov/vuln/detail/CVE-2024-13454
[2] https://github.com/OpenVPN/easy-rsa/issues/1122

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 7bcad09c02)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-02-12 15:00:47 +01:00
Thomas Perale
2cdadeb453 package/mp4v2: add CPE
The CPE `mp4v2:mp4v2` is valid for the package mp4v2. See the latest
CVE: CVE-2023-33719 that reference the upstream repository.

[1] https://nvd.nist.gov//vuln/detail/CVE-2023-33719

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 5a03ffed80)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-02-12 15:00:40 +01:00
Thomas Perale
da873e5a11 package/podman: add CPE
Add the `podman_project:podman` CPE referenced in the GHSA page [1].

The last entry with this CPE is CVE-2024-3056 [2].

Dropping the `v` prefix from the version to track the CPE version
correctly.

[1] https://github.com/containers/podman/security
[2] https://nvd.nist.gov//vuln/detail/CVE-2024-3056

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 3848bea3c3)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-02-12 15:00:30 +01:00
Thomas Perale
d94991e1f0 package/docker-engine: update CPE
While `docker:docker` is not marked as deprecated by NVD after a
scan through the CVEs the last entry for `docker:docker`
is CVE-2022-34883 [1]. Replacing this tuple with `mobyproject:moby` that
is referenced in the upstream project GHSA [2]. The last entry for this
CPE is CVE-2025-54410 [3].

Note: Quoting [4], "Moby is an open framework created by Docker to
assemble specialized container systems without reinventing the wheel".
The old github URL [5] redirects to [6].

[1] https://nvd.nist.gov//vuln/detail/CVE-2023-5166
[2] https://github.com/moby/moby/security/advisories
[3] https://nvd.nist.gov//vuln/detail/CVE-2025-54410
[4] https://mobyproject.org/
[5] https://github.com/docker/docker
[6] https://github.com/moby/moby

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
[Julien: add the note about the Moby project]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 9abaa88df9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-02-12 14:59:54 +01:00
Bernd Kuhls
8b3854b54a package/safeclib: fix build with gcc >= 14.x
Backport two upstream patches to fix build errors introduced by the
bump of gcc to 14.x.

Fixes:
https://autobuild.buildroot.net/results/af6/af65e6386439098ddf706ca43e99320cf5e9fd80/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 34749a2d3e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-02-12 14:59:34 +01:00
Bernd Kuhls
dfedd20a8c package/safeclib: properly format upstream information in patch
Patch 0001 has the upstream information, just not properly formatted,
so we fix this.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Thomas: extracted from a bigger patch from Bernd]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit c15b507838)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-02-12 14:58:53 +01:00
El Mehdi YOUNES
48c6ff60b2 package/rust-bindgen: add runtime host-clang dependency
According to the official requirements, bindgen needs libclang to
parse C/C++ headers. libclang is loaded at runtime by bindgen, which
is why we didn't notice any build issue. However, using bindgen on a
simple header file blows up:

thread 'main' panicked at bindgen/lib.rs:616:27:
Unable to find libclang: "couldn't find any valid shared libraries matching: ['libclang.so', 'libclang-*.so', 'libclang.so.*', 'libclang-*.so.*'], s
et the `LIBCLANG_PATH` environment variable to a path where one of these files can be found (invalid: [])"
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

So far, bindgen was only used by mesa3d, and it turns out that mesa3d
also depends on clang, which pulls in host-clang, so the problem was
not visible. However, as we're about to use bindgen for other
things (namely Rust support in Linux), this issue needs to be fixed.

See:

  https://rust-lang.github.io/rust-bindgen/requirements.html

Signed-off-by: El Mehdi YOUNES <elmehdi.younes@smile.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 34ed3bbf0a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-02-12 14:57:07 +01:00
Giulio Benetti
1297635187 DEVELOPERS: add Giulio Benetti to package bind
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 2f218b1c29)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-02-12 14:56:33 +01:00
Peter Korsgaard
faa3db1e32 package/mpg123: add sdl2 support
mpg123 supports (and prefers) SDL2 as well for the sdl backends since 1.26.9
with:

792615f651

So support that here as well.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 53c2c0903d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-02-12 14:56:15 +01:00
Fiona Klute
41fbe94c70 Makefile: add check-package-external target
The new target provides a convenient way to run utils/check-package on
any external trees, using .checkpackageignore files from the
respective trees if present.

While .checkpackageignore should be used as little as possible, in a
few cases adding overrides for false-positives to the affected files
is not feasible, a practical example of this is a Markdown file
misidentified as Python by libmagic (likely due to code blocks).

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
[Arnout: set ${ignore} explicitly to empty, in case it exists in the
environment.]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit fe48905080)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-02-12 14:55:39 +01:00
Marcus Hoffmann
bdc77eddfe support/testing: test_python_sdbus_modemmanager: remove unneeded systemd vconsole
The test failed in the past, due to kbd build failure. See [1].
This specific issue was fixed by commit [2].

This commit was originally written to workaround this issue, which was
unrelated to the actual package being tested. Since systemd-vconsole
is not needed anyway, this commit removes it from the test config.

[1] https://gitlab.com/buildroot.org/buildroot/-/jobs/12363929666
[2] d98d9ba28f

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
[Julien: reword the commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 287d06f5d7)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-02-12 14:54:07 +01:00
Marcus Hoffmann
d2caf50d54 support/testing: fix SdbusModemmanager/SdbusNetworkmanager duplicate test name
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 02386bb34d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-02-12 14:53:51 +01:00