mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-10-22 17:02:01 -09:00
Code Issues Packages Projects Releases Wiki Activity
83,635 Commits 6 Branches 487 Tags
a9d4e45d9590c9358e42454fc8c3be5bddccfff2
Commit Graph

83635 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Bernd Kuhls
a9d4e45d95 package/netsnmp: fix build with OpenSSL 4.0.0 
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-09-28 13:50:21 +02:00
Bernd Kuhls
0edc67470b package/opensc: add support for OpenSSL 4.0.0 
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-09-28 13:37:21 +02:00
Bernd Kuhls
79e1d59d27 package/gloox: fix build with OpenSSL 4.0.0 
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-09-28 13:36:00 +02:00
Bernd Kuhls
061a33b36a package/mender: fix build with OpenSSL 4.0.0 
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-09-28 13:26:46 +02:00
Bernd Kuhls
3caf39eb79 package/pkcs11-helper: add support for OpenSSL 4.0.0 
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-09-28 13:24:40 +02:00
Bernd Kuhls
0b1caae22b package/mtd: fix build with OpenSSL 4.0.0 
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-09-28 13:24:00 +02:00
Yegor Yefremov
441ccd8dab package/libsoup3: fix static build 
Since the bump to 3.7.3, libsoup unconditionally includes <dlfcn.h>
in soup-init.c to detect whether libsoup2 is loaded in the same
process. Static-only toolchains such as uClibc-ng without shared
library support don't provide this header, so the build fails:

../libsoup/soup-init.c:21:10: fatal error: dlfcn.h: No such file or directory

Add a patch, submitted upstream, that checks for dlfcn.h at configure
time and skips the libsoup2 detection when it is not available.

Fixes:
https://autobuild.buildroot.org/results/4effebe5fc12146749e704dd56f695363cc8fbc3

Fixes: 55cec1d013 ("package/libsoup3: bump to 3.7.3")
Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Assisted-by: Claude:claude-opus-5
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-09-28 13:06:42 +02:00
Bernd Kuhls
df39c8c524 package/asterisk: fix build with OpenSSL 4.0.0 
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-09-28 10:23:05 +02:00
Bernd Kuhls
e523c64d3b package/asterisk: bump version to 22.11.0 
https://community.asterisk.org/t/asterisk-release-22-11-0/114073

https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-22.11.0.html
Security Advisories Resolved: 0

Switched to tarball provided by upstream.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-09-27 18:56:44 +02:00
Bernd Kuhls
96a2337bd4 package/asterisk: bump bundled pjsip to 2.17 
Buildroot commit 7f48325de6 bumped the
asterisk package from 22.9.0 to 22.10.1.

This bump includes upstream commit
5d543ad80c
which bumped the bundled pjsip package to 2.17.

To allow offline builds we download the pjsip tarball so we need to keep
the version numbers in sync.

The autobuilders logs show a download process:
https://autobuild.buildroot.net/results/400/400e53158f11926446c11d22681eb8a9430caf1d/build-end.log

checking for embedded pjproject (may have to download)... configuring
[pjproject]  Downloading https://raw.githubusercontent.com/asterisk/third-party/master/pjproject/2.17/pjproject-2.17.tar.bz2 to
               /home/autobuild/autobuild/instance-3/dl/asterisk/pjproject-2.17.tar.bz2
[pjproject]  Verifying /home/autobuild/autobuild/instance-3/dl/asterisk/pjproject-2.17.tar.bz2

where the tarball was once stored in the configured download directory:

  --with-download-cache=$(ASTERISK_DL_DIR)

to be used during later autobuilder runs.

Fixes: 7f48325de6 ("package/asterisk: security bump to 22.10.1")
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Thomas: add comment in .mk file]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-09-27 18:55:45 +02:00
Peter Seiderer
ea9d29a8af package/chrony: bump version to 4.9 
- bump version to 4.9 (for details see [1])

[1] https://chrony-project.org/news.html#27_aug_2026_chrony_4_9_released

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-09-27 15:05:15 +02:00
Giulio Benetti
633d368bae package/wireshark: security bump to v4.4.19 
Fixes the following vulnerabilities:

- wnpa-sec-2026-93 · SCTP protocol dissector crash.
  https://www.wireshark.org/security/wnpa-sec-2026-93
  CVE-2026-95389.

- wnpa-sec-2026-96 · IEEE C37.118 Synchrophasor protocol dissector
  memory leak.
  https://www.wireshark.org/security/wnpa-sec-2026-96
  CVE-2026-95395.

- wnpa-sec-2026-97 · SPDY protocol dissector crash.
  https://www.wireshark.org/security/wnpa-sec-2026-97
  CVE-2026-95387.

- wnpa-sec-2026-98 · Microsoft Network Monitor file parser large loop.
  https://www.wireshark.org/security/wnpa-sec-2026-98
  CVE-2026-95394.

- wnpa-sec-2026-99 · CSN.1 protocol dissector crash.
  https://www.wireshark.org/security/wnpa-sec-2026-99
  CVE-2026-95393.

- wnpa-sec-2026-100 · MBIM protocol dissector crash. wsbuglink:21549,
  https://www.wireshark.org/security/wnpa-sec-2026-100
  CVE-2026-95392.

- wnpa-sec-2026-101 · Sharkd utility crash.
  https://www.wireshark.org/security/wnpa-sec-2026-101
  CVE-2026-95388.

- wnpa-sec-2026-102 · Frame protocol metadissector crash.
  https://www.wireshark.org/security/wnpa-sec-2026-102
  CVE-2026-96422.

- wnpa-sec-2026-103 · USB HID protocol dissector infinite loop and
  memory leak.
  https://www.wireshark.org/security/wnpa-sec-2026-103
  CVE-2026-96421.

- wnpa-sec-2026-104 · RF4CE protocol dissector crash.
  https://www.wireshark.org/security/wnpa-sec-2026-104
  CVE-2026-96417.

- wnpa-sec-2026-105 · Toshiba file parser crash.
  https://www.wireshark.org/security/wnpa-sec-2026-105
  CVE-2026-xxx.

- wnpa-sec-2026-106 · Profile import crash and possible code execution.
  https://www.wireshark.org/security/wnpa-sec-2026-106
  CVE-2026-96419.

- wnpa-sec-2026-107 · TIFF protocol dissector infinite loop.
  https://www.wireshark.org/security/wnpa-sec-2026-107
  CVE-2026-96418.

- wnpa-sec-2026-108 · X11 protocol dissector crash.
  https://www.wireshark.org/security/wnpa-sec-2026-108
  CVE-2026-96423.

- wnpa-sec-2026-109 · IEEE 802.11 protocol dissector crash.
  https://www.wireshark.org/security/wnpa-sec-2026-109
  CVE-2026-96416.

- wnpa-sec-2026-110 · Catapult DCT2000 protocol dissector crash.
  https://www.wireshark.org/security/wnpa-sec-2026-110
  CVE-2026-96415.

For more information on the version bump, see:
  - https://www.wireshark.org/docs/relnotes/wireshark-4.4.19.html

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-09-27 12:09:40 +02:00
Peter Seiderer
236fd61a83 package/iptables: bump version to 1.8.13 
- bump version to 1.8.13 (for details see [1] and [2])
- remove 0001-nft-fix-interface-comparisons-in-C-commands.patch
  (from upstream [3])

[1] https://netfilter.org/projects/iptables/files/changes-iptables-1.8.12.txt
[2] https://netfilter.org/projects/iptables/files/changes-iptables-1.8.13.txt
[3] https://git.netfilter.org/iptables/commit/?id=40406dbfaefbc204134452b2747bae4f6a122848

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-09-27 10:58:22 +02:00
Peter Seiderer
7626aada6a package/nftables: bump version to 1.1.7 
- bump version to 1.1.7 (for details see [1])
- update coreteam gpg key URL to newer key (used since nftables-1.1.1)

[1] https://git.netfilter.org/nftables/log/?h=v1.1.7

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-09-27 10:58:22 +02:00
Peter Seiderer
94143f61e4 package/libnftnl: bump version to 1.3.2 
- bump version to 1.3.2 (for details see [1])
- change sha256 URL to https
- update coreteam gpg key URL to newer key (used since libnftnl-1.2.9)

[1] https://git.netfilter.org/libnftnl/log/?h=libnftnl-1.3.2

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-09-27 10:58:22 +02:00
Peter Seiderer
b19b1caaef package/dhcpcd: bump version to 10.5.2 
- bump version to 10.5.2 (for details see [1], [2])

https://github.com/NetworkConfiguration/dhcpcd/releases/tag/v10.5.2
https://github.com/NetworkConfiguration/dhcpcd/releases

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-09-27 10:42:22 +02:00
Peter Seiderer
1caeb632a6 package/ntpsec: security bump version to 1.2.5 
Fixes: CVE-2026-18321:
https://nvd.nist.gov/vuln/detail/cve-2026-18321

- bump version to 1.2.5 (for details see [1])
- rebased 0001-wscript-remove-checks-for-bsd-string.h-fixes-host-co.patch
- rebased 0002-disable-PIE-support.patch
- removed 0003-ntpd-refclock_gpsd.c-Add-missing-time.h-for-strptim.patch
  (from upstream [2])
- moved 0004-refclock_gpsd-add-build-fix-for-gcc-14.x.patch to
  0003-refclock_gpsd-add-build-fix-for-gcc-14.x.patch, rebased and enhanced
  as the original conflicts with upstream commit 5505260c ("Fix redefined
  _XOPEN_SOURCE warning in refclock_gpsd.c") [3] and leads to the following
  compile failure:

    ../../ntpd/refclock_gpsd.c:113:21: error: operator ‘<’ has no left operand
      113 |   #if _XOPEN_SOURCE < 700
          |                     ^

[1] https://lists.ntpsec.org/pipermail/devel/2026-July/011029.html
[2] 5137c155d8
[3] 5505260cd1

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
[Julien: mark commit as "security bump"]
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-09-27 10:23:34 +02:00
Bernd Kuhls
063863ee5c package/samba4: bump version to 4.25.0 
https://www.samba.org/samba/history/samba-4.25.0.html

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-09-26 12:08:46 +02:00
Bernd Kuhls
f07eeff6df package/php: security bump version to 8.5.11 
https://news-web.php.net/php.announce/506
https://www.php.net/ChangeLog-8.php#8.5.11
https://github.com/php/php-src/blob/php-8.5.11/NEWS

Fixes CVE-2025-1218, CVE-2025-14181, CVE-2026-6103, CVE-2026-17545,
CVE-2026-91765, CVE-2026-91766, CVE-2026-91767, CVE-2026-91768,
CVE-2026-91769, CVE-2026-92842 & CVE-2026-93682.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-09-26 11:32:14 +02:00
Bernd Kuhls
80114e20e4 {linux, linux-headers}: bump 7.2.x, 6.18.x series 
Update the latest kernel releases to:
- 7.2.7 -> 7.2.8
- 6.18.53 -> 6.18.54

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
 2026-09-25 22:11:08 +02:00
Adrian Perez de Castro
0867818a73 package/bubblewrap: security bump to version 0.13.0 
While there are no CVEs for this Bubblewrap release, it includes a fix
to ensure that arguments that receive a path are not empty (which before
treated those as the root directory: a bit of a footgun!), and that is a
follow-up to the security fixes included in 0.12.0.

Additionally, it patches a number of build failures, which fixes e.g.:

  https://autobuild.buildroot.org/results/2eb2d222daaadc2eb16b42fa2ec102ab0689f038
  https://autobuild.buildroot.org/results/674413f089ce9b80a59058674b3ef6879e1d389c

Release notes:

  https://github.com/containers/bubblewrap/releases/tag/v0.13.0

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-09-25 21:11:52 +02:00
Titouan Christophe
a962be2eea package/xen: bump to version 4.22.0 
See the release notes:
https://wiki.xenproject.org/wiki/Xen_Project_4.22_Release_Notes?ref=xenproject.org

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-09-25 13:51:03 +02:00
Titouan Christophe
0bf8b2ecee package/xen: add x86_64 target 
Add support for building xen for x86_64 targets. In this initial version,
do not build extra bootloaders which would require additional download
infrastructure.

Assisted-by: Claude:opus-5.5
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-09-25 13:51:03 +02:00
Bernd Kuhls
e7bbe36be8 package/fetchmail: bump version to 6.6.8 
https://sourceforge.net/p/fetchmail/mailman/message/59396310/
"It also includes fetchmail 6.6.7's security bugfix for NTLM, which
has now been assigned CVE-2026-94184."

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-09-24 21:05:30 +02:00
Bernd Kuhls
15ea2f8221 package/llvm-project: bump version to 23.1.2 
https://discourse.llvm.org/t/llvm-23-1-2-released/91895

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-09-24 20:29:50 +02:00
Bernd Kuhls
08b06173bd package/flutter-engine: fix build with pango >= 1.58.0 
Buildroot commit c3aa677456 bumped pango
to 1.58.0 causing a build error with flutter-engine

../../flutter/shell/platform/linux/fl_accessible_text_field.cc:9:1:
 error: redefinition of 'glib_autoptr_clear_PangoContext'
    9 | G_DEFINE_AUTOPTR_CLEANUP_FUNC(PangoContext, g_object_unref)

../../flutter/shell/platform/linux/fl_accessible_text_field.cc:60:3:
 error: 'cleanup' argument is not a function
   60 |   g_autoptr(PangoContext) context = get_pango_context(self);

with this defconfig:

BR2_x86_64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_PACKAGE_MESA3D=y
BR2_PACKAGE_MESA3D_GALLIUM_DRIVER_SOFTPIPE=y
BR2_PACKAGE_MESA3D_OPENGL_EGL=y
BR2_PACKAGE_MESA3D_OPENGL_ES=y
BR2_PACKAGE_FLUTTER_ENGINE=y
BR2_PACKAGE_LIBGTK3=y

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-09-24 19:23:33 +02:00
Giulio Benetti
4919a5fecf package/nfs-utils: bump version to 3.3.1 
Remove patches upstreamed in this release.

Release announce:
https://lore.kernel.org/linux-nfs/5717a803-805c-409f-a9cc-d0c33a365570@redhat.com/

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-09-23 21:37:45 +02:00
Bernd Kuhls
dc5cb8f02d package/tor: security bump version to 0.4.9.13 
https://gitlab.torproject.org/tpo/core/tor/-/blob/tor-0.4.9.13/ReleaseNotes

TROVE-2026-012, TROVE-2026-030, TROVE-2026-038, TROVE-2026-041,
TROVE-2026-050, TROVE-2026-051, TROVE-2026-052, TROVE-2026-053,
TROVE-2026-056 & TROVE-2026-058.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-09-23 21:33:55 +02:00
Bernd Kuhls
67380a32f7 package/expat: security bump version to 2.8.5 
https://github.com/libexpat/libexpat/blob/R_2_8_5/expat/Changes
https://blog.hartwork.org/posts/expat-2-8-5-released/

Fixes CVE-2026-93990.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-09-23 21:29:34 +02:00
Michael Fischer
74fe3559d6 package/sdl3_image: security bump to version 3.4.6 
For release notes, see:
https://github.com/libsdl-org/SDL_image/releases

3.1.1 was a preview release. Among the changes since, it fixes the XCF
loader issue reported as CVE-2026-35444 (fixed in 3.4.2). See:
https://github.com/libsdl-org/SDL_image/releases/tag/release-3.4.2

The LICENSE.txt hash changes because the copyright year was updated
upstream. The license itself is unchanged (Zlib).

Signed-off-by: Michael Fischer <mf@go-sys.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-09-22 22:38:24 +02:00
Alsey Coleman Miller
2e4036e3a0 package/plutovg: new package 
plutovg is a standalone 2D vector graphics library providing path
filling and stroking, gradients and text rendering. It is the renderer
plutosvg is built on.

Examples are not built: they are demo programs that are never installed.

Signed-off-by: Alsey Coleman Miller <alseycmiller@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-09-22 21:28:32 +02:00
Julien Olivain
e2b81003a4 .checkpackageignore: remove entry for mrouted package 
Buildroot commit [1] (package/mrouted: fix invalid daemon path in
S41mrouted) removed script execution permission but forgot to remove
the corresponding .checkpackage entry.

check-package is reporting the error:

    package/mrouted/S41mrouted:0: NotExecutable was expected to fail, did you fix the file and forget to update /builds/buildroot.org/buildroot/.checkpackageignore?

This commit fixes the issue by removing the entry.

Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/16661195972

[1] d8f408b1f1

Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-09-22 20:14:35 +02:00
Joachim Wiberg
1e62d0b062 package/mrouted: bump to version 4.7 
Multiple changes upstream, for the full list of changes, see the release
notes: https://github.com/troglobit/mrouted/releases/tag/4.7

Package changes:

- Drop local backported patch, merged in 4.7

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-09-22 19:08:08 +02:00
Joachim Wiberg
d8f408b1f1 package/mrouted: fix invalid daemon path in S41mrouted 
S41mrouted hard-coded /sbin/mrouted, but mrouted has always installed
to /usr/sbin/mrouted. This went unnoticed with BR2_ROOTFS_MERGED_USR=y,
but the daemon fails to start without it.

Also drop the script's executable bit to match other sysv init
scripts that do not set it.

Introduced in c25115daf2
(package/mrouted: add sysv init script).

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-09-22 19:08:03 +02:00
Bernd Kuhls
5ce1dc60fb package/libde265: bump version to 1.1.3 
https://github.com/strukturag/libde265/releases/tag/v1.1.3

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-09-22 19:02:24 +02:00
Fiona Klute
7eede98528 package/kbd: fix static build with uClibc 
Since upstream commit 7fdd8debe37ae52812b77d82e08713bd62c607f4 [1]
(included from release 2.9.0) libkbdfile unconditionally includes
dlfcn.h. uClibc provides this header only if shared library support is
enabled [2], so building kbd fails if BR2_TOOLCHAIN_BUILDROOT_UCLIBC=y
and BR2_STATIC_LIBS=y (BR2_SHARED_STATIC_LIBS=y works).

The issue has been fixed upstream [3], backport the patch.

[1] https://git.kernel.org/pub/scm/linux/kernel/git/legion/kbd.git/commit/?id=7fdd8debe37ae52812b77d82e08713bd62c607f4
[2] https://github.com/wbx-github/uclibc-ng/blob/v1.0.59/Makefile.in#L260
[3] https://github.com/legionus/kbd/issues/159

Fixes: 930660890b
Fixes: https://autobuild.buildroot.org/results/872d12bf869717ae8aec9a2ed6295cf8f7e8b098/
Fixes: https://autobuild.buildroot.org/results/056b5fe4ca230989041a1ed166c1b509f8bb0908/

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-09-22 18:52:21 +02:00
Bernd Kuhls
309ea70367 package/utfcpp: bump version to 4.2.1 
https://github.com/nemtrif/utfcpp/releases/tag/v4.2.1

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-09-22 18:50:41 +02:00
Stephan Hoffmann
f18c4dbdce package/libhttpserver: bump to version 2.0.0 
Version 2.0.0 requires C++20 and GCC 11 or newer.

This major release changes the API exposed to applications. However,
the 0.x release series is end-of-life, so staying on version 0.19.0 is
not a viable option.

The build system detects GnuTLS through its headers and links to it
directly. Make this detection deterministic by following the
libmicrohttpd SSL option and adding the corresponding dependency.

https://github.com/etr/libhttpserver/releases/tag/2.0.0

Signed-off-by: Stephan Hoffmann <sho@relinux.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-09-22 18:47:12 +02:00
Giulio Benetti
b5ce8971bb package/harfbuzz: bump version to 14.5.0 
https://github.com/harfbuzz/harfbuzz/blob/14.5.0/NEWS

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-09-22 18:37:01 +02:00
Bernd Kuhls
b0511042e8 package/bpftrace: bump version to 0.27.0 
https://github.com/bpftrace/bpftrace/blob/v0.27.0/CHANGELOG.md

This release includes
d7a3bb54a3
which adds support for LLVM 23.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-09-22 12:32:49 +02:00
Bernd Kuhls
2a0a1c19c1 {linux, linux-headers}: bump 6.12.x, 6.18.x, 7.2.x series 
Update the latest kernel releases to:
 - 6.12.110 -> 6.12.111
 - 6.18.52 -> 6.18.53
 - 7.2.6 -> 7.2.7

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
 2026-09-22 11:04:10 +02:00
Koen Martens
81060d467f DEVELOPERS: remove Koen Martens from capnproto and linuxconsoletools 
I have left the field of software engineering and will no longer
contribute.

Signed-off-by: Koen Martens <gmc@sonologic.nl>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
 2026-09-22 11:01:38 +02:00
Yann E. MORIN
a489e7c212 package/skopeo: use new upstream location 
The upstream location has changed (with a forward from the old one, so
we did not notice earlier) [0] [1], with 1.23.0 the first release being
made from the new location, which was accounted for in 96aac440dd
(package/skopeo: bump version to 1.23.0) as it required the change of
the gomod, but where the new location was missed.

Eventually switch to the new location now.

[0] https://github.com/podman-container-tools/skopeo/pull/2854
[1] https://github.com/podman-container-tools/go.podman.io/pull/6

Reported-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
 2026-09-22 10:57:29 +02:00
Bernd Kuhls
45f1c387e0 package/llvm-project: bump version to 23.1.1 
https://discourse.llvm.org/t/llvm-23-1-1-released/91760

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-09-21 20:51:09 +02:00
Yann E. MORIN
b2c69fe0a4 package/skopeo: security bump to version 1.24.1 
Changelog:
https://github.com/podman-container-tools/skopeo/releases/tag/v1.24.1

This releases brings in a fix for:
* CVE-2025-11395

Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
[Julien: add info in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-09-21 19:44:07 +02:00
Yann E. MORIN
e80a249f49 package/docker-credential-gcr: bump version to 2.2.1 
Changelog since v2.1.32:
https://github.com/GoogleCloudPlatform/docker-credential-gcr/releases/tag/v2.2.1
https://github.com/GoogleCloudPlatform/docker-credential-gcr/releases/tag/v2.2.0
https://github.com/GoogleCloudPlatform/docker-credential-gcr/releases/tag/v2.1.33

Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
[Julien: add info in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-09-21 19:44:03 +02:00
Yann E. MORIN
02cc32ee5c package/distribution-registry: security bump to version 3.1.1 
Changelog since v3.0.0:
https://github.com/distribution/distribution/releases/tag/v3.1.0
https://github.com/distribution/distribution/releases/tag/v3.1.1

This feature-release also contains security fixes:
* CVE-2026-35172
* CVE-2026-33540
* CVE-2026-41888

Drop our backported patch, included since 3.1.0

Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
[Julien: add info in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-09-21 19:43:55 +02:00
Bernd Kuhls
dbf3c1f7bf package/linux-firmware: bump version to 20260916 
Updated the hash of the WHENCE file, due to firmware additions and
firmware changes, but no changes to the redistribution/licensing
conditions.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-09-21 19:19:08 +02:00
Chen Pei
e88c26904b package/iniparser: bump version to 4.3.0 
https://gitlab.com/iniparser/iniparser/-/releases/v4.3.0

Bugfix release: fixes stack-buffer-overflows in escape_value(),
iniparser_getseckeys(), iniparser_getsecnkeys() and
iniparser_dumpsection_ini(). Adds iniparser_load_buffer() to parse ini
data from memory and generates version number constants. The SONAME
major version is unchanged.

Signed-off-by: Chen Pei <cp0613@linux.alibaba.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-09-21 19:08:55 +02:00
Bernd Kuhls
43de288bd1 package/qt6: security bump version to 6.11.2 
https://code.qt.io/cgit/qt/qtreleasenotes.git/about/qt/6.11.2/release-note.md

Security fixes:
CVE-2026-16762 in qtbase
CVE-2026-19248 in qtbase
CVE-2026-13326 in qtconnectivity
CVE-2026-8168 in qtsvg

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-09-20 16:56:55 +02:00