mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-09 07:51:59 -09:00
Code Issues Packages Projects Releases Wiki Activity
68,055 Commits 6 Branches 483 Tags
a240f9da855fc4a01ae1a1a755722f8fc3773705
Commit Graph

68055 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Peter Korsgaard
a240f9da85 package/nodejs: security bump to version 16.20.0 
Fixes the following security issues:

- CVE-2023-23918: Node.js Permissions policies can be bypassed via
  process.mainModule (High)

- CVE-2023-23919: Node.js OpenSSL error handling issues in nodejs crypto
  library (Medium)

- CVE-2023-23920: Node.js insecure loading of ICU data through ICU\_DATA
  environment variable (Low)

- CVE-2023-23936: Fetch API in Node.js did not protect against CRLF
  injection in host headers (Medium)
  https://github.com/nodejs/undici/security/advisories/GHSA-5r9g-qh6m-jxff

- CVE-2023-24807: Regular Expression Denial of Service in Headers in Node.js
  fetch API (Low)
  https://github.com/nodejs/undici/security/advisories/GHSA-r6ch-mqf9-qc9w

For more details, see the advisory:
https://nodejs.org/en/blog/vulnerability/february-2023-security-releases

Update LICENSE hash after an update of the openssl license snippet:
e7ed56f501

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
 2023-06-19 21:36:41 +02:00
Peter Korsgaard
0afcfe5a48 package/c-ares: security bump to version 1.19.1 
Fixes the following security issues:

- CVE-2023-32067: High.  0-byte UDP payload causes Denial of Service
- CVE-2023-31147 Moderate.  Insufficient randomness in generation of DNS
  query IDs
- CVE-2023-31130.  Moderate.  Buffer Underwrite in ares_inet_net_pton()
- CVE-2023-31124.  Low.  AutoTools does not set CARES_RANDOM_FILE during
  cross compilation

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
 2023-06-19 21:36:40 +02:00
Peter Korsgaard
fa1d011a05 package/python-django: security bump to version 4.1.9 
Fixes the following security issues:

- CVE-2023-31047: Potential bypass of validation when uploading multiple
  files using one form field

https://www.djangoproject.com/weblog/2023/may/03/security-releases/

In addition, 4.1.8 fixed a bug related to secrets rotation:
https://docs.djangoproject.com/en/4.2/releases/4.1.8/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
 2023-06-19 21:36:39 +02:00
Bernd Kuhls
6508581652 package/ccache: fix license hash 
Buildroot commit 1db3f0f844 failed to
update the license hash which is needed due to various commits in 2023
updating package versions and copyright year:
https://github.com/ccache/ccache/commits/master/LICENSE.adoc

Fixes:
http://autobuild.buildroot.net/results/41b/41b3427e30b6e44352fc78b27360fdadf9e46393/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
 2023-06-19 21:36:37 +02:00
Bernd Kuhls
6dfc789f4f package/check: switch to cmake 
The autoconf-build system fails to properly detect vsnprintf

    checking for vsnprintf... yes
    checking whether vsnprintf is C99 compliant... no

which leads to a build error

    snprintf.c:495:1: error: inlining failed in call to 'always_inline'
     'rpl_vsnprintf.localalias': function not inlinable

Building with cmake fixes the problem:

-- Looking for vsnprintf
-- Looking for vsnprintf - found

The cmake build system has an option to disable checkmk, so we don't
need to remove it from target anymore.

Fixes:
http://autobuild.buildroot.net/results/e55/e5562513226de902dae642526165b1555a540144/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
 2023-06-19 21:36:36 +02:00
Bernd Kuhls
d4a96ee46e linux: fix kernel hashes 
Fixes commit which added hashes for wrong files:
https://git.busybox.net/buildroot/commit/?id=88108f9793f5824fa058b878974f234ebe834325

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
 2023-06-18 21:21:30 +02:00
Bernd Kuhls
f36c57728a package/hwdata: install to staging 
hwdata provides a .pc file, which other packages can look up to find the
location where hwdata files are, and use them at build time.

This is the case for the upcoming libdisplay-info package, which
requires the hwdata's PNP IDs at build time.

However, installing the .pc file is not enough. Indeed, meson (which
libdisplay-info uses) will look for the corresponding data files in
datadir, which it locates relative to the sysroot, which is our staging.

So, we also need to install the hwdata files in staging.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
 2023-06-18 18:10:21 +02:00
Joachim Wiberg
d7a7d93be4 package/inadyn: update description, how to enable HTTPS support 
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
 2023-06-18 15:30:33 +02:00
Joachim Wiberg
7faf0389fd package/inadyn: bump to v2.11.0 
Upstream ChageLog, summary:

 - Add wildcard support for Cloudflare
 - New DDNS providers from DD-WRT;
     - goip.de
     - myonlineportal.net
     - desec.io (a.k.a. dedyn.io)
     - domaindiscount24.com
     - dy.fi
     - do.de (Domain-Offensive)
     - Domopoli.de
     - inwx
     - It's DNS
     - Joker.com
     - all-inkl.com
     - core-networks.de
     - dnsever.com
     - dnshome.de
     - dnsmadeeasy.com
     - dnsmax.com
     - schokokeks.org
     - variomedia.de
     - udmedia.de
     - moniker.com
     - dyndns.it
     - infomaniak.com
     - oray.com
     - simply.com
     - mydns.jp
     - myonlineportal.net
     - namecheap.com
     - regfish.de
     - twodns.de
 - Support for updating both ipv4 and ipv6 address for same provider
 - Add new command line options -L and -S NAME to list supported
   providers and their respective details
 - Add 'success' as a valid generic response to DNS update
 - Fix use after free in logger at inadyn exit
 - Use dynv6 'auto' IP only if we have not detected an address
 - Replace unstable api.ipify.org with http://ifconfig.me
 - Fix default checkip server for dnsexit.com
 - Fix easydns response code problem

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
 2023-06-18 15:28:17 +02:00
James Hilliard
049adbb607 package/zxing-cpp: bump to version 2.0.0 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
 2023-06-18 15:27:02 +02:00
James Hilliard
eee958dcc4 package/python-cython: bump to version 0.29.35 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
 2023-06-18 15:26:24 +02:00
James Hilliard
374c6be269 package/python-flit-core: bump to version 3.9.0 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
 2023-06-18 15:17:43 +02:00
James Hilliard
da7db0d553 package/python-installer: bump to version 0.7.0 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
 2023-06-18 15:17:20 +02:00
James Hilliard
9aa45c0f89 package/python-pillow: bump to version 9.5.0 
License hash changed due to wording update:
997932bc93

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
 2023-06-18 15:15:35 +02:00
James Hilliard
c97e81251d package/python-pycryptodomex: bump to version 3.18.0 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
 2023-06-18 15:13:59 +02:00
James Hilliard
3f1f0597e2 package/python-pydal: bump to version 20230521.1 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
 2023-06-18 15:13:37 +02:00
James Hilliard
4e15d69160 package/python-pydantic: bump to version 1.10.8 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
 2023-06-18 15:13:14 +02:00
James Hilliard
78c9982d71 package/python-pydyf: bump to version 0.6.0 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
 2023-06-18 15:11:55 +02:00
James Hilliard
20e9218513 package/python-pygments: bump to version 2.15.1 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
 2023-06-18 15:11:06 +02:00
James Hilliard
962b1a7023 package/python-pyphen: bump to version 0.14.0 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
 2023-06-18 15:10:09 +02:00
James Hilliard
c94922beac package/python-requests: bump to version 2.31.0 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
 2023-06-18 15:09:26 +02:00
James Hilliard
c46b025420 package/python-selenium: bump to version 4.9.1 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
 2023-06-18 15:08:46 +02:00
James Hilliard
4f50a8cad0 package/python-yarl: bump to version 1.9.2 
License file now contains the full Apache 2.0 license instead of just a
reference to it:
cc4a11e961

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
 2023-06-18 15:06:17 +02:00
James Hilliard
7978383cb0 package/python-weasyprint: bump to version 59.0 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
 2023-06-18 15:04:27 +02:00
James Hilliard
7c46dd628e package/python-txaio: bump to version 23.1.1 
License has changed due to company name update:
91dace6ad1

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
 2023-06-18 15:04:06 +02:00
James Hilliard
795f4ffbd9 package/python-setuptools: bump to version 67.8.0 
License hash changed due to name removal:
5957d58266

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
 2023-06-18 15:03:13 +02:00
James Hilliard
155ccd6775 package/{rust, rust-bin}: bump to version 1.70.0 
Link to Rust 1.70.0 announcement: https://blog.rust-lang.org/2023/06/01/Rust-1.70.0.html

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
 2023-06-18 15:03:12 +02:00
James Hilliard
49109a317e package/python-setuptools-rust: bump to version 1.6.0 
Drop no longer required host-python-setuptools-scm and
host-python-toml dependencies.

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
 2023-06-18 15:03:11 +02:00
Bernd Kuhls
b91524f373 package/nettle: bump version to 3.9.1 
Release notes:
https://lists.gnu.org/archive/html/info-gnu/2023-05/msg00007.html
https://lists.gnu.org/archive/html/info-gnu/2023-06/msg00000.html

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-06-18 14:46:52 +02:00
Bernd Kuhls
21674cb1f7 package/ncurses: bump version to 6.4.20230603 
Release notes:
https://github.com/ThomasDickey/ncurses-snapshots/blob/master/NEWS

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-06-18 14:46:32 +02:00
Bernd Kuhls
f8af24707b package/mpg123: bump version to 1.31.3 
Removed md5 hash, switched _SITE to https.

Updated license hash due to copyright year bump.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-06-18 14:46:21 +02:00
Bernd Kuhls
2043ee1ab3 package/mcelog: bump version to 194 
Changelog:
https://git.kernel.org/pub/scm/utils/cpu/mce/mcelog.git/log/

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-06-18 14:46:12 +02:00
Bernd Kuhls
afe56719db package/intel-gmmlib: bump version to 22.3.7 
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-06-18 14:46:04 +02:00
Bernd Kuhls
88108f9793 {linux, linux-headers}: bump 4.{14, 19}.x / 5.{4, 10, 15}.x / 6.{1, 3}.x series 
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-06-18 13:44:40 +02:00
Peter Korsgaard
39ffadd6ae package/jhead: security bump to version 3.08 
Fixes the following security issue:

- CVE-2022-41751: Jhead 3.06.0.1 allows attackers to execute arbitrary OS
  commands by placing them in a JPEG filename and then using the
  regeneration -rgt50 option.

Update readme.txt hash after a minor tweak of the text:
a0eed69daa

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-06-18 13:43:56 +02:00
Bernd Kuhls
c3c4b6356e package/{mesa3d, mesa3d-headers}: bump version to 23.1.2 
Release notes:
https://lists.freedesktop.org/archives/mesa-announce/2023-May/000721.html
https://lists.freedesktop.org/archives/mesa-announce/2023-June/000722.html

Removed patch which is included in this version bump:
https://cgit.freedesktop.org/mesa/mesa/commit/?id=2630f4b310f534c830250be44d285e485da83869

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-06-18 13:42:45 +02:00
Bernd Kuhls
b7b11d7e94 package/python3: security bump version to 3.11.4 
Rebased two patches.

Changelog:
https://docs.python.org/release/3.11.4/whatsnew/changelog.html#python-3-11-4

Fixes the following security problems:

- gh-99889: Fixed a security in flaw in uu.decode() that could allow for
  directory traversal based on the input if no out_file was specified.

- gh-104049: Do not expose the local on-disk location in directory
  indexes   produced by http.client.SimpleHTTPRequestHandler.

- gh-102153: urllib.parse.urlsplit() now strips leading C0 control and
  space characters following the specification for URLs defined by WHATWG
  in response to CVE-2023-24329. Patch by Illia Volochii.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-06-18 13:40:59 +02:00
Bernd Kuhls
1116fd46a4 package/ghostscript: security bump version to 10.01.1 
Switch tarball to .xz

Fixes CVE-2023-28879:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28879

Release notes:
https://ghostscript.readthedocs.io/en/latest/News.html?utm_source=ghostscript&utm_medium=website&utm_content=inline-link

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-06-18 13:39:07 +02:00
Bernd Kuhls
914ef9cec2 package/flatbuffers: bump version to 23.5.26 
Changelog:
https://github.com/google/flatbuffers/blob/master/CHANGELOG.md

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-06-18 13:38:29 +02:00
Bernd Kuhls
8d3f69b4ea package/fetchmail: bump version to 6.4.37 
Release notes:
https://sourceforge.net/p/fetchmail/mailman/message/37770051/
https://sourceforge.net/p/fetchmail/mailman/message/37783197/

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-06-18 13:37:57 +02:00
Bernd Kuhls
3c957d0df1 package/ethtool: bump version to 6.3 
Release notes:
https://git.kernel.org/pub/scm/network/ethtool/ethtool.git/tree/NEWS

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-06-18 13:37:45 +02:00
Francois Perrad
9a141f7ec5 package/mc: bump to version 4.8.29 
Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-06-18 13:36:46 +02:00
Francois Perrad
043d0e6f6c package/libgtk3: bump to version 3.24.38 
Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-06-18 13:35:15 +02:00
Bernd Kuhls
5db037e1e5 package/libplist: bump version to 2.3.0 
Release notes:
https://github.com/libimobiledevice/libplist/releases/tag/2.3.0

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-06-18 13:34:51 +02:00
Bernd Kuhls
34f6e68a8c package/libinput: bump version to 1.23.0 
Release notes:
https://lists.freedesktop.org/archives/wayland-devel/2022-June/042245.html
https://lists.freedesktop.org/archives/wayland-devel/2022-November/042515.html
https://lists.freedesktop.org/archives/wayland-devel/2023-January/042583.html
https://lists.freedesktop.org/archives/wayland-devel/2023-March/042642.html

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-06-18 13:33:33 +02:00
Bernd Kuhls
cc69dbf8fd package/libedit: bump version to 20221030-3.1 
Rebased patch, switched _SITE to https.

Changelog: https://www.thrysoee.dk/editline/

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-06-18 13:30:05 +02:00
Bernd Kuhls
6a70ffd6e9 package/libcodec2: bump version to 1.1.0 
Removed patch which is included in this version.

Release notes: https://github.com/drowe67/codec2/releases/tag/v1.1.0

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-06-18 13:29:41 +02:00
Bernd Kuhls
3fc82816b4 package/libcap: security bump version to 2.69 
Fixes
- CVE-2023-2602
  https://git.kernel.org/pub/scm/libs/libcap/libcap.git/commit/?id=bc6b36682f188020ee4770fae1d41bde5b2c97bb
- CVE-2023-2603
  https://git.kernel.org/pub/scm/libs/libcap/libcap.git/commit/?id=422bec25ae4a1ab03fd4d6f728695ed279173b18

Updated license hash due to an upstream commit which added a SPDX header:
https://git.kernel.org/pub/scm/libs/libcap/libcap.git/commit/?id=70998415a87587f31063a26a1e52c6f7806b7834

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-06-18 13:29:12 +02:00
Bernd Kuhls
c136b777df package/less: bump version to 633 
Removed patch which is included in this version.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-06-18 13:28:49 +02:00
Bernd Kuhls
34c2252e8c package/leafpad: bump version to 0.8.19 
Changelog: https://github.com/tarot231/leafpad/blob/main/ChangeLog

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-06-18 13:28:39 +02:00