Disable building of man pages, which is now a separate option from
building html docs[1].
Add conditional support for parsing the NVMe Boot Firmware Table NBFT)
depending on whether libnvme is available.
Changes [2]:
=============================================
NetworkManager-1.56
Overview of changes since NetworkManager-1.54
=============================================
* Unify the versioning to use everywhere the scheme with the -rcX or -dev
suffixes when appropriate. This affects, for example, the URL and filename
of the release tarball and the version reported by nmcli and the daemon.
As an exception, the C API will continue to use the 90+ scheme for RC versions.
* nmcli now supports viewing and managing WireGuard peers.
* Support reapplying the "sriov.vfs" property as long as
"sriov.total-vfs" is not changed.
* Support reapplying "bond-port.vlans".
* Accept hostnames longer than 64 characters from DNS lookup.
* Make that global-dns configuration overwrites DNS searches and
options from connections, instead of merging all together.
* Add support for a new rd.net.dhcp.client-id option in
nm-initrd-generator.
* Add gsm device-uid setting to restrict the devices the connection applies to.
* Support configuring the HSR protocol version via the
"hsr.protocol-version" property.
* Fix a bug that makes broadband connections auto-connect getting
blocked if the connection tries to reconnect when modem status is
"disconnecting" / "disconnected".
* Treat modem connection not having an operator code available
as a recoverable error.
* Add support for configuring systemd-resolved's DNSSEC option
per-connection via the "connection.dnssec" connection property.
* Support configuring the HSR interlink port via the
"hsr.interlink" property.
* Fix some connection properties not being applied to vpn connections
(connection.mdns, connection.llmnr, connection.dns-over-tls,
connection.mptcp-flags, ipv6.ip6-privacy)
* Update n-acd to always compile with eBPF enabled, as support
for eBPF is now detected at run time.
* Add new MPTCP 'laminar' endpoint type, and set it by default alongside
the 'subflow' one.
* For private connections (the ones that specify a user in the
"connection.permissions" property), verify that the user can access
the 802.1X certificates and keys set in the connection.
* Introduce a libnm function that can be used by VPN plugins to check
user permissions on certificate and keys.
=============================================
NetworkManager-1.54
Overview of changes since NetworkManager-1.52
=============================================
* Add support for configuring per-device IPv4 forwarding via the
"ipv4.forwarding" connection property.
* Add a new "prefix-delegation" setting containing a "subnet-id"
property that specifies the subnet to choose on the downstream
interface when using IPv6 prefix delegation.
* Support OCI baremetal in nm-cloud-setup
* When activating a WireGuard connection to an IPv6 endpoint, now
NetworkManager creates firewall rules to ensure that the incoming
packets are not dropped by kernel reverse path filtering.
* Add support for configuring the loopback interface in nmtui.
* Most of the properties of ovs-bridge and ovs-port connections can
now be reapplied at runtime without bringing the connection down.
* Add a new "sriov.preserve-on-down" property that controls whether
NetworkManager preserves the SR-IOV parameters set on the device
when the connection is deactivated, or whether it resets them to
their default value.
* Introduce a new "ovs-dpdk.lsc-interrupt" property to configure the
Link State Change (LSC) detection mode for OVS DPDK interfaces.
* The initrd-generator now can parse the NVMe Boot Firmware Table
(NBFT) to configure networking during early boot.
* Add systemd services to provide networking in the initrd.
[1] a11760ef39
[2] https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/blob/nm-1-56/NEWS
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Tested-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Overview of changes since NetworkManager-1.52.1[1]
* Support reapplying the "sriov.vfs" property as long as
"sriov.total-vfs" is not changed.
* For private connections (the ones that specify a user in the
"connection.permissions" property), verify that the user can access
the 802.1X certificates and keys set in the connection.
* Introduce a libnm function that can be used by VPN plugins to check
user permissions on certificate and keys.
[1] https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/blob/1.52.2/NEWS
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
NetworkManager stopped requiring intltool with 1.40:
56b51b98fb/NEWS (L434)
Fixes: e7c20ad548
host-gettext is already an indirect dependency via package/libglib2.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
[Marcus: add reference to commit that updated NM to 1.40]
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
There is no such option, and according to the commit history never
was. If BR2_PACKAGE_HOST_PYTHON3_SSL=y the build adds host-openssl to
HOST_PYTHON3_DEPENDENCIES directly.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
https://download.gnome.org/sources/libxml2/2.15/libxml2-2.15.3.news
- parser: Pass userData to SAX text callbacks in xmlParseReference (type-confusion)
- entities: copy children in xmlCopyEntity
- c14n: Fix Type confusion in xmlC14NProcessAttrsAxis
- python: Do not decref string after adding to the list (double-free / use-after-free)
- c14n: Reuse tmp_str, xmlStrcat reallocates *cur (double-free)
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Building this defconfig
BR2_x86_64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_PACKAGE_NEON=y
BR2_PACKAGE_NEON_ZLIB=y
does not build libneon with zlib support, quoting configure log:
configure: zlib not enabled
although the configure parameter
--with-zlib=/home/bernd/buildroot/output/host/x86_64-buildroot-linux-gnu/sysroot
was used.
The reason is the addition of "=$(STAGING_DIR)" to --with-zlib which was
added to buildroot in 2008 with commit
cc6562ff83.
The upstream code, which expects only "yes", all other values lead to
the else-condition, is unchanged since 2004:
https://github.com/notroj/neon/blame/0.37.1/macros/neon.m4#L478
so a backport of this patch to LTS branches should be considered.
With this patch the configure log shows:
checking for zlib.h... yes
checking for inflate in -lz... yes
configure: zlib support enabled, using -lz
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
https://github.com/stevegrubb/libcap-ng/blob/v0.9.3/ChangeLog
The source tarball is not distributed on the project site anymore so we
switch to the github helper and need to enable autoreconf.
Added dependency to BR2_TOOLCHAIN_HAS_SYNC_4 to fix a build error:
/home/bernd/buildroot/test-libcap/bootlin-sparc-uclibc/host/opt/ext-toolchain/bin/../lib/gcc/sparc-buildroot-linux-uclibc/14.3.0/../../../../sparc-buildroot-linux-uclibc/bin/ld:
../src/.libs/libcap-ng.so: undefined reference to `__sync_bool_compare_and_swap_4'
due to this upstream commit added in version 0.9.2:
ba2e9e0319
Added _POST_EXTRACT_HOOKS and dependency to host-pkgconf to fix
autoreconf errors.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
- sources are now hosted on Github
- ficl have its own LICENSE file
- remove one upstreamed patch
- support only static lib
- requires C11
Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The 6.19.x series is now EOL upstream, so drop the linux-headers
option and add legacy handling for it.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Commit 1c11f9020a removed the patch
changing configure.ac with the bump to 6.10, so it is no longer
needed.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Django 6.0.4 fixes one security issue with severity “moderate”, four
security issues with severity “low”, and several bugs in 6.0.3.
Security issues:
* CVE-2026-3902: ASGI header spoofing via underscore/hyphen conflation
ASGIRequest normalizes header names following WSGI conventions, mapping
hyphens to underscores. As a result, even in configurations where
reverse proxies carefully strip security-sensitive headers named with
hyphens, such a header could be spoofed by supplying a header named with
underscores.
Under WSGI, it is the responsibility of the server or proxy to avoid
ambiguous mappings. (Django’s runserver was patched in CVE 2015-0219.)
But under ASGI, there is not the same uniform expectation, even if many
proxies protect against this under default configuration (including
nginx via underscores_in_headers off;).
Headers containing underscores are now ignored by ASGIRequest, matching
the behavior of Daphne, the reference server for ASGI.
This issue has severity “low” according to the Django security policy.
* CVE-2026-4277: Privilege abuse in GenericInlineModelAdmin¶
Add permissions on inline model instances were not validated on
submission of forged POST data in GenericInlineModelAdmin.
This issue has severity “low” according to the Django security policy.
* CVE-2026-4292: Privilege abuse in ModelAdmin.list_editable¶
Admin changelist forms using list_editable incorrectly allowed new
instances to be created via forged POST data.
This issue has severity “low” according to the Django security policy.
* CVE-2026-33033: Potential denial-of-service vulnerability in
MultiPartParser via base64-encoded file upload¶
When using django.http.multipartparser.MultiPartParser, multipart
uploads with Content-Transfer-Encoding: base64 that include excessive
whitespace may trigger repeated memory copying, potentially degrading
performance.
This issue has severity “moderate” according to the Django security policy.
* CVE-2026-33034: Potential denial-of-service vulnerability in
ASGI requests via memory upload limit bypass¶
ASGI requests with a missing or understated Content-Length header could
bypass the DATA_UPLOAD_MAX_MEMORY_SIZE limit when reading
HttpRequest.body, potentially loading an unbounded request body into
memory and causing service degradation.
This issue has severity “low” according to the Django security policy.
Bugfixes:
* Fixed a regression in Django 6.0 where alogin() and alogout() did not
respectively set or clear request.user if it had already been
materialized (e.g., by sync middleware) (#37017).
* Fixed a regression in Django 6.0 in admin forms where
RelatedFieldWidgetWrapper incorrectly wrapped all widgets in a
<fieldset> (#36949).
* Fixed a bug in Django 6.0 where the fields.E348 system check did not
detect name clashes between model managers and related_names for
non-self-referential relationships (#36973).
Release Notes:
https://docs.djangoproject.com/en/6.0/releases/6.0.4/
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
