Commit Graph

77300 Commits

Author SHA1 Message Date
Marcus Hoffmann
c100f6a2fe DEVELOPERS: add Marcus Hoffmann for python-pydantic packages
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2025-05-16 16:19:51 +02:00
Marcus Hoffmann
3648cec128 package/python-typing-extensions: bump to 4.13.2
Release notes:
https://github.com/python/typing_extensions/blob/main/CHANGELOG.md#release-4132-april-10-2025

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2025-05-16 16:19:50 +02:00
Marcus Hoffmann
1126be8fdf package/python-dotenv: bump to 1.1.0
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2025-05-16 16:19:50 +02:00
Marcus Hoffmann
cde5e50b73 package/python-pydantic-settings: bump to 2.9.1
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2025-05-16 16:19:49 +02:00
Marcus Hoffmann
e1c939e426 package/python-pydantic: bump 2.11.4
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2025-05-16 16:19:48 +02:00
Marcus Hoffmann
e42de820cd package/python-pydantic-core: bump to 2.34.1
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
[Arnout: update hash for cargo3]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2025-05-16 16:19:47 +02:00
Marcus Hoffmann
9b6e7bf7ee package/python-typing-inspection: new package
Add python-typing-inspection as a newly introduced dependency of
pydantic.

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2025-05-16 16:19:46 +02:00
Marcus Hoffmann
0468aae90a package/python-anyio: bump to 4.9.0
Release notes: https://github.com/agronholm/anyio/releases/tag/4.9.0

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2025-05-16 16:19:45 +02:00
Marcus Hoffmann
c912dc1d27 package/python-starlette: bump to 0.46.2
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2025-05-16 16:19:44 +02:00
Marcus Hoffmann
873e1d658a package/python-fastapi: bump to 0.115.12
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2025-05-16 16:19:43 +02:00
Thomas Perale
0814b614c2 package/micropython: fix build with GCC 15
A set of `unterminated-string-initialization` errors appeared when
building the micropython package with GCC15 on the host.
The autobuilder failed to build the package micropython with the
following error:

```
CC ../py/emitinlinethumb.c
../py/emitinlinethumb.c:153:9: error: initializer-string for array of 'unsigned char' truncates NUL terminator but destination lacks 'nonstring' attribute (4 chars into 3 available) [-Werror=unterminated-string-initialization]
  153 |     {0, "r0\0"},
      |         ^~~~~~
../py/emitinlinethumb.c:154:9: error: initializer-string for array of 'unsigned char' truncates NUL terminator but destination lacks 'nonstring' attribute (4 chars into 3 available) [-Werror=unterminated-string-initialization]
  154 |     {1, "r1\0"},
      |         ^~~~~~
...
```

This patch adds the set of upstream commits to fix the compatbility with
GCC15 (see [1]).
The patches were backported to micropython v1.22.2. The main difference
with the upstream version is that since the v1.23, the project removed the
use of the `STATIC` macro (see [2]).

Also, in the codebase of v1.22.2 the 'unterminated-string-initialization'
error occured in another file that was reworked in the patch [3] and
included in v1.25. This patch is included as well to remove the error in
v1.22.2.

[1] package/micropython/0003-Fixes-for-GCC-15-1-unterminated-string-literal-warning.patch
[2] decf8e6a8b
[3] package/micropython/0002-py-emitinlinextensa-Simplify-register-name-lookup.patch

Fixes: https://autobuild.buildroot.org/results/fdf/fdf1d7c3e3a51e6fc7fa5abea57de6c9ce792015

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-05-16 16:14:32 +02:00
Kadambini Nema
9868ca6ec9 package/libopenssl: bump version to 3.5.0
Release notes:
https://github.com/openssl/openssl/releases/tag/openssl-3.5.0

Changelog:
https://github.com/openssl/openssl/blob/master/CHANGES.md#openssl-35

Rebased patches for the new version.

Signed-off-by: Kadambini Nema <kadambini.nema@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-05-16 15:45:33 +02:00
James Hilliard
22cd2e0bc4 package/unifdef: fix build with gcc 15
Add a patch fixing compilation on hosts with gcc 15.

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-05-16 15:36:13 +02:00
Olivier Benjamin
f5d4ed04ac package/psplash: bump to revision 53ae74a
This includes the following changes:

53ae74a configure.ac: fix autoconf code for img_fullscreen
ec1ed35 configure.ac: standardize default-enabled options
1f64c65 README: Update mailing list to point to yocto-patches ml
b1a75fd psplash: Only define bool if using C standard older than C23
5a32cf6 psplash.c: fix crash from length becoming negative
ecc1913 SECURITY.md: Add file

Signed-off-by: Olivier Benjamin <olivier.benjamin@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-05-16 15:31:48 +02:00
Julien Olivain
2e05f22ff8 configs/freescale_imx93frdm: new defconfig
This commit adds support for the i.MX 93 FRDM (Freedom) board.

The i.MX93 FRDM development board is a low-cost and compact
development board featuring the i.MX93 applications processor.

See: https://nxp.com/FRDM-IMX93

This defconfig is based on freescale_imx93evk_defconfig introduced
by Sébastien, in Cc.

Note: the Linux and U-Boot repositories are forks. This is because
the NXP software team did not included all the necessary i.MX93 FRDM
patches in the standard NXP i.MX BSP at the time of this commit.
Instead, patches were published in a dedicated Yocto Layer from [1].
The forks used in this defconfig are simply the repositories [2]
and [3] with patches from [1] applied on them. This is only to make this
defconfig simpler in the meantime the BSP patches are included in the
NXP BSP repositories.

Thanks to Martin Chabot for lending a board!

[1] https://github.com/nxp-imx-support/meta-imx-frdm
[2] https://github.com/nxp-imx/uboot-imx
[3] https://github.com/nxp-imx/linux-imx

Cc: Martin Chabot <martin.chabot@gmail.com>
Cc: Sébastien Szymanski <sebastien.szymanski@armadeus.com>
Tested-by: Julien Olivain <ju.o@free.fr>
[Julien: Tested on board 700-94611 Rev B1]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Reviewed-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-05-16 15:26:06 +02:00
Thomas Petazzoni
b473d99416 package/libcap: backport upstream patch to fix build on Xtensa
Following the bump of libcap to version 2.76 in commit
e2eb2ee58b, the build started failing on
Xtensa. The bug was reported upstream at
https://bugzilla.kernel.org/show_bug.cgi?id=219915 and was
subsequently fixed by upstream commit:

  https://git.kernel.org/pub/scm/libs/libcap/libcap.git/commit/?id=6cdd8cd72ebcedd6b1b6c989a7e5722d5d87f35c

Which we backport in this commit.

Fixes:

  https://autobuild.buildroot.org/results/b9ff9258f407898eeee80dd8cc4dd1d777f44c06

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-05-16 15:12:22 +02:00
Thomas Perale
45439ae262 package/python-flask: security bump to version 3.1.1
Fixes the following security issues:

- CVE-2025-47278: In Flask 3.1.0, the way fallback key configuration was
    handled resulted in the last fallback key being used for signing,
    rather than the current signing key.

For more information, see:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-47278
  - 73d6504063

For more details on the version bump, see the release notes:
  - https://github.com/pallets/flask/releases/tag/3.1.1

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-05-16 13:55:09 +02:00
Marcus Hoffmann
fa5771d975 package/libiio: bump to 0.26
Drop patch that is now merged upstream.

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-05-16 13:54:02 +02:00
Brandon Maier
0c230eef90 package/mtd: update to 2.3.0
Changelog: https://git.infradead.org/?p=mtd-utils.git;a=blob;f=CHANGELOG.md

The TestMtd build fails with the following error

  checking pkg-config is at least version 0.9.0... ./configure: line
  5375: .../output/TestMtd/host/bin/pkg-config: No such file or
  directory

So we promote host-pkgconf to be a required dependency for the build.

Signed-off-by: Brandon Maier <brandon.maier@collins.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-05-16 13:53:18 +02:00
Peter Korsgaard
9a1aaec3f3 package/screen: security bump to version 5.0.1
Fixes the following security issues:

CVE-2025-46805: do NOT send signals with root privileges
CVE-2025-46804: avoid file existence test information leaks
CVE-2025-46803: apply safe PTY default mode of 0620
CVE-2025-46802: prevent temporary 0666 mode on PTYs in attacher
CVE-2025-23395: reintroduce lf_secreopen() for logfile

https://lists.gnu.org/archive/html/info-gnu/2025-05/msg00002.html

For more details, see:
https://security.opensuse.org/2025/05/12/screen-security-issues.html

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-05-16 13:40:17 +02:00
El Mehdi YOUNES
3615b2cd04 package: update all hashes after cargo3 switch
This updates all SHA256 hashes for Rust packages that previously used
cargo2.tar.gz archives, following the switch to cargo3 naming in my last
patch.

Signed-off-by: El Mehdi YOUNES <elmehdi.younes@smile.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2025-05-16 13:26:33 +02:00
El Mehdi YOUNES
b80278613e package/pkg-download: switch from cargo2 to cargo3
Starting from rust 1.84.0 (cargo 1.84.0), published crates now always
include a Cargo.lock file. Originally it was only included for packages
that have executables or examples for use with cargo install. see [1]

This behaviour change alters the contents of the .tar.gz archives,
which causes SHA256 hash mistmatches when trying to build Rust packages.

Example build failure with bat-0.24.0:

ERROR: while checking hashes from package/bat/bat.hash
ERROR: bat-0.24.0-cargo2.tar.gz has wrong sha256 hash:
ERROR: expected: 45fcdd6076dc1b45698a7b6c0f4d1f5d9ae676f3ca3b155402ad24680d5b4df6
ERROR: got     : 28b302b1aa325221796d4ebb25bacab19a8927ef32f4d56a965b32a7b1c102fc

After using the ne hash to download the new archive tar.gz, we have the
difference between the old archive and the new one using diffoscope:
│ │ --rw-r--r--   0        0        0     1529 2023-10-11 17:14:12.000000 bat-0.24.0/VENDOR/bincode/.cargo-checksum.json
│ │ +-rw-r--r--   0        0        0     1609 2023-10-11 17:14:12.000000 bat-0.24.0/VENDOR/bincode/.cargo-checksum.json
│ │ +-rw-r--r--   0        0        0     1766 2023-10-11 17:14:12.000000 bat-0.24.0/VENDOR/bincode/Cargo.lock
│ │  -rw-r--r--   0        0        0     1388 2023-10-11 17:14:12.000000 bat-0.24.0/VENDOR/bincode/Cargo.toml

We can see that Cargo.lock has been added.

To avoid hash mismatch issues and to clearly mark archives generated
with the new Cargo behavior, we migrate the naming from 'cargo2.tar.gz'
to 'cargo3.tar.gz'.

We did not find any alternative to disable this new cargo-publish
behavior, so this change is necessary to allow updating the hashes of
Cargo-fetched packages.

[1] https://github.com/rust-lang/cargo/pull/14815
https://doc.rust-lang.org/nightly/cargo/CHANGELOG.html

Signed-off-by: El Mehdi YOUNES <elmehdi.younes@smile.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2025-05-16 13:26:32 +02:00
El Mehdi YOUNES
072f3bc8c6 package/rust: bump to version 1.86.0
bump rust from version 1.82.0 to 1.86.0
releases:
https://github.com/rust-lang/rust/releases

Signed-off-by: El Mehdi YOUNES <elmehdi.younes@smile.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2025-05-16 13:26:32 +02:00
El Mehdi YOUNES
740204bf9a package/rust: fix bootstrap with Rust≥1.83
Rust includes an option `download-ci-llvm` in config.toml that enables
downloading prebuilt LLVM binaries from Rust's CI infrastructure instead
of building LLVM from source. This option helps speed up the bootstrap
process and is enabled by default starting from Rust 1.83.

However, starting from commit [1] the bootstrap process performs
a strict check via the function
check_incompatible_options_for_ci_llvm().

This validation, implemented in the function
check_incompatible_options_for_ci_llvm(), checks for any incompatible
custom options such as `llvm.ldflags`, `llvm.cflags`, `targets`, etc.

If any of these are set locally and differ from the values used to build
the CI-provided LLVM, the build fails immediately with the error:

      ERROR: Setting `llvm.ldflags` is incompatible with
             `llvm.download-ci-llvm`.

Buildroot explicitly sets `llvm.ldflags` in rust.mk to ensure proper
host linking during the build of host-rust. Removing this setting may
introduce portability or reliability issues across toolchains.

To address the issue without compromising the build environment, this
patch disables the use of CI-provided LLVM by setting:

      [llvm]
      download-ci-llvm = false

This follows the recommendation from the Rust bootstrap script itself.

Note: this is a temporary workaround to restore compatibility with Rust
≥1.83. Other solutions will be investigated to avoid disabling the use
of prebuilt LLVM in the future, while preserving Buildroot’s reproducible
build setup.

[1] 9df7680ecf

Signed-off-by: El Mehdi YOUNES <elmehdi.younes@smile.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2025-05-16 13:26:31 +02:00
Julien Olivain
e9911873aa configs/freescale_imx*: bump BSP components to lf-6.12.3-1.0.0
This commit U-Boot, Linux kernel and ATF (when applicable) to the
NXP BSP lf-6.12.3-1.0.0 versions.

Custom hashes are also updated accordingly.

Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-05-16 12:49:35 +02:00
Sébastien Szymanski
2f13e813c0 package/freescale-imx/imx-sc-firmware: bump version to 1.18.0
This version is aligned with NXP Linux BSP version "lf-6.12.3-1.0.0".

License hashes changed because the LA_OPT_NXP_Software_License changed
from "v57 July 2024" to "v58 November 2024".

Signed-off-by: Sébastien Szymanski <sebastien.szymanski@armadeus.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-05-16 12:49:35 +02:00
Sébastien Szymanski
33778c8552 package/freescale-imx/imx-vpu-hantro-daemon: bump version to 1.5.0
This version is aligned with NXP Linux BSP version "lf-6.12.3-1.0.0".

Signed-off-by: Sébastien Szymanski <sebastien.szymanski@armadeus.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-05-16 12:49:35 +02:00
Sébastien Szymanski
4fe6235126 package/freescale-imx/imx-vpu-hantro: bump version to 1.36.0
This version is aligned with NXP Linux BSP version "lf-6.12.3-1.0.0".

License hashes changed because the LA_OPT_NXP_Software_License changed
from "v57 July 2024" to "v58 November 2024".

Signed-off-by: Sébastien Szymanski <sebastien.szymanski@armadeus.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-05-16 12:49:35 +02:00
Sébastien Szymanski
05b20d572c package/freescale-imx/imx-gpu-viv: bump version to 6.4.11.p3.0
This version is aligned with NXP Linux BSP version "lf-6.12.3-1.0.0".

License hashes changed because the LA_OPT_NXP_Software_License changed
from "v57 July 2024" to "v58 November 2024".
The Vivante.icd file is now in gpu-core/etc/OpenCL/vendors/ and there is
a new directory "vulkan" in gpu-core/etc/. Copy both OpenCL and vulkan
directories to /etc/.

Signed-off-by: Sébastien Szymanski <sebastien.szymanski@armadeus.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-05-16 12:49:35 +02:00
Sébastien Szymanski
9d0e9e07a8 package/freescale-imx/firmware-ele-imx: bump to version 2.0.1
This version is aligned with NXP Linux BSP version "lf-6.12.3-1.0.0".

License hashes changed because the LA_OPT_NXP_Software_License changed
from "v57 July 2024" to "v58 November 2024".

Signed-off-by: Sébastien Szymanski <sebastien.szymanski@armadeus.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-05-16 12:49:35 +02:00
Sébastien Szymanski
20246264e5 package/freescale-imx/imx-gpu-g2d: bump version to 6.4.11.p3.0
This version is aligned with NXP Linux BSP version "lf-6.12.3-1.0.0".

License hashes changed because the LA_OPT_NXP_Software_License changed
from "v57 July 2024" to "v58 November 2024".

Signed-off-by: Sébastien Szymanski <sebastien.szymanski@armadeus.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-05-16 12:49:35 +02:00
Sébastien Szymanski
15c91ed9b5 package/freescale-imx/firmware-imx: bump version to 8.27
This version is aligned with NXP Linux BSP version "lf-6.12.3-1.0.0".

License hashes changed because the LA_OPT_NXP_Software_License changed
from "v57 July 2024" to "v58 November 2024".

Signed-off-by: Sébastien Szymanski <sebastien.szymanski@armadeus.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-05-16 12:49:35 +02:00
Patrik Olsson
506c9b8e0d configs/friendlyarm_nanopi_r3s: bump TF-A, U-Boot and Linux versions
- TF-A to version v2.12 (LTS)
- U-Boot to version v2025.04
- Linux kernel to version 6.14.6

Signed-off-by: Patrik Olsson <johan.patrik.olsson@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-05-16 12:41:55 +02:00
Patrik Olsson
42357f0b13 configs/friendlyarm_nanopi_r3s: use Bootlin toolchain
This moves the defconfig to the Bootlin glibc stable external toolchain
as per[1].

[1]: https://elinux.org/Buildroot:DeveloperDaysELCE2024#Rules_for_defconfigs

Signed-off-by: Patrik Olsson <johan.patrik.olsson@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-05-16 12:41:55 +02:00
Fiona Klute (WIWA)
a32a1e9a84 package/rauc: enable JSON output in host package
JSON output is useful for building integrations, e.g. reading bundle
information into other tools.

Host-json-glib is very small / fast to build compared to the other
dependencies, so enable it unconditionally.

Signed-off-by: Fiona Klute (WIWA) <fiona.klute@gmx.de>
[Peter: unconditionally enable JSON support]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-05-16 12:36:50 +02:00
Kadambini Nema
a127b7e999 package/openssh: bump to version 10.0p1
Release notes:
https://www.openssh.com/txt/release-10.0

Install sshd-auth.
6072e4c938

Also, the release note of 10.0p1 states it is a security update for
CVE-2025-32728. This commit is not marked as security bump, because the
security fix is already present in Buildroot since commit [1]. For this
reason, this commit also removes the package patches and the
_IGNORE_CVES variable.

[1] 211e822d43

Signed-off-by: Kadambini Nema <kadambini.nema@gmail.com>
[Julien:
 - remove the "security" mention commit title
 - remove local patches and _IGNORE_CVES
 - add info in commit log
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-05-16 12:08:05 +02:00
Julien Olivain
00b2d74dbb package/kexec: bump to version 2.0.31
For release announce, see:
https://lists.infradead.org/pipermail/kexec/2025-April/032608.html

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-05-16 11:49:56 +02:00
Julien Olivain
634b2c5253 package/fluidsynth: bump to version 2.4.5
For change log since v2.4.3, see:
https://github.com/FluidSynth/fluidsynth/releases/tag/v2.4.4
https://github.com/FluidSynth/fluidsynth/releases/tag/v2.4.5

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-05-16 11:48:02 +02:00
Cherniaev Andrei
4e95062f82 package/pkg-meson: use buildroot-build for build directory
Fixes https://gitlab.com/buildroot.org/buildroot/-/issues/64

Some source tarballs (E.G.  libopenh264) may already contain a build/
subdir, so switch to the more unique bildroot-build for the build directory,
similar to how it is done for cmake.

Signed-off-by: Cherniaev Andrei <dungeonlords789@naver.com>
Co-Authored-By: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
[Peter: reword commit text]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-05-16 11:42:56 +02:00
Titouan Christophe
211e822d43 package/openssh: apply security patch for CVE-2025-32728 (sshd)
Fixes:
https://www.cve.org/CVERecord?id=CVE-2025-32728

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
[Julien: add link to CVE in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-05-16 11:19:36 +02:00
Kadambini Nema
aaa50b0e61 package/xz: bump to version 5.8.1
Update hash of the COPYING file. (Notes about old releases was removed)

Release notes:
https://github.com/tukaani-project/xz/releases/tag/v5.8.1
https://github.com/tukaani-project/xz/releases/tag/v5.8.0

Also, the release note of v5.8.1 states it is a security update for
CVE-2025-31115. This commit is not marked as security bump, because the
security fix is already present in Buildroot since commit [1]. For this
reason, this commit also removes the package patches and the
XZ_IGNORE_CVES variable.

[1] 38494a0a61

Signed-off-by: Kadambini Nema <kadambini.nema@gmail.com>
[Julien:
 - remove the "security" mention commit title
 - remove local patches and XZ_IGNORE_CVES
 - add info in commit log
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-05-16 10:55:25 +02:00
Peter Korsgaard
d9182a7556 docs/website/download.html: update for 2025.02.1
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-05-16 10:25:31 +02:00
Julien Olivain
6ad8090920 configs/freescale_t1040d4rdb: bump linux kernel to 6.12.27
Since commit [1] "package/binutils: make 2.43 the default version",
the freescale_t1040d4rdb_defconfig fails to build the Linux
kernel, with the error:

    arch/powerpc/boot/util.S: Assembler messages:
    arch/powerpc/boot/util.S:49: Error: junk at end of line, first unrecognized character is `0'
    arch/powerpc/boot/util.S:54: Error: syntax error; found `b', expected `,'
    arch/powerpc/boot/util.S:54: Error: junk at end of line: `b'

This commit fixes the issue by updating the Linux kernel to the latest
LTS version.

Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/9967089767

[1] 360fd01de2

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-05-16 10:15:47 +02:00
Julien Olivain
889d47baef configs/freescale_p1025twr: bump linux kernel to 6.12.27
Since commit [1] "package/binutils: make 2.43 the default version",
the freescale_p1025twr_defconfig fails to build the Linux
kernel, with the error:

    arch/powerpc/boot/util.S: Assembler messages:
    arch/powerpc/boot/util.S:49: Error: junk at end of line, first unrecognized character is `0'
    arch/powerpc/boot/util.S:54: Error: syntax error; found `b', expected `,'
    arch/powerpc/boot/util.S:54: Error: junk at end of line: `b'

This commit fixes the issue by updating the Linux kernel to the latest
LTS version.

Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/9967089759

[1] 360fd01de2

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-05-16 10:15:22 +02:00
Julien Olivain
8bfdd3305e package/libsndfile: update project home page url
The libsndfile package homepage url [1] points to an old site in which
the last update is for version 1.0.28 (April 2 2017). This site does
not seem to be maintained anymore.

This commit updates the libsndfile homepage url to [2].

[1] http://www.mega-nerd.com/libsndfile/
[2] https://libsndfile.github.io/libsndfile/

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-05-16 10:14:35 +02:00
Thomas Devoogdt
84d9cf3abe package/fluent-bit: bump to 4.0.2
News:
- https://fluentbit.io/announcements/v4.0.1/
- https://fluentbit.io/announcements/v4.0.2/

Other remarks:
- Drop the FLB_UNICODE_ENCODER option, as it is no longer needed. [1]

- Added support for FLB_OUT_PGSQL.

- Compile against the buildroot provided zstd package. [2]

- Dropped some patches as they are obsolete. (We use the buildroot packages for them.)
   - 0003-lib-nghttp2-CMakeLists.txt-do-not-require-a-CXX-comp.patch
   - 0004-lib-luajit-cmake-CMakeLists.txt-do-not-require-a-CXX.patch
   - 0006-lib-zstd-only-enable-CXX-support-if-tests-are-requir.patch

- Synced the other patches with their upstream equivalent.

[1] 92de130cea
[2] 5f409f55ec

Signed-off-by: Thomas Devoogdt <thomas@devoogdt.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-05-16 09:46:01 +02:00
Thomas Perale
a4249a2024 package/libraw: security bump to version 0.21.4
Fixes the following security issues:

- CVE-2025-43961: metadata/tiff.cpp has an out-of-bounds read in the
    Fujifilm 0xf00c tag parser.

For more information, see:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-43961
  - 66fe663e02

- CVE-2025-43962: phase_one_correct in decoders/load_mfbacks.cpp has
    out-of-bounds reads for tag 0x412 processing

For more information, see:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-43962
  - 66fe663e02

- CVE-2025-43963: phase_one_correct in decoders/load_mfbacks.cpp allows
    out-of-buffer access

For more information, see:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-43963
  - be26e7639e

- CVE-2025-43964: tag 0x412 processing in phase_one_correct in
    decoders/load_mfbacks.cpp does not enforce minimum w0 and w1 values.

For more information, see:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-43964
  - a50dc3f112

For more details on the version bump, see the release notes:
  - https://github.com/LibRaw/LibRaw/releases/tag/0.21.4
  - https://github.com/LibRaw/LibRaw/releases/tag/0.21.3
  - https://github.com/LibRaw/LibRaw/compare/0.21.2...0.21.4

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-05-15 07:51:32 +02:00
Marcus Hoffmann
c722fa1cf2 package/python-django: bump to 5.2.1
Django 5.2 is a new LTS series. Release notes and announcement:

https://docs.djangoproject.com/en/5.2/releases/5.2/
https://www.djangoproject.com/weblog/2025/apr/02/django-52-released/

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-05-14 15:03:38 +02:00
Marcus Hoffmann
09299c5b0c package/python-django: security bump to 5.1.9
Fixes CVE-2025-32873 [1].
Django also updates setuptools[2], so we can remove the --skip-dependency-check
flag and need to update the package archive capitalization accordingly.

[1] https://www.djangoproject.com/weblog/2025/may/07/security-releases/
[2] bbf376bbc8

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-05-14 14:57:57 +02:00
Julien Olivain
38494a0a61 package/xz: add security patches fixing CVE-2025-31115
This commit adds four upstream patches fixing the CVE-2025-31115
vulnerability. The reason there is four patches instead of one is to
exactly follow the advisory recommendation [1], which proposes the
patch [2]. This patch is in fact a concatenation of four commits. In
Buildroot, we track package patches as formatted by git, with extra
"Upstream:" headers. The patch [2] was split here in four for a
clearer traceability.

With the addition of those patches, the XZ_IGNORE_CVES is set
accordingly.

Fixes:
https://www.cve.org/CVERecord?id=CVE-2025-31115

[1] https://github.com/tukaani-project/xz/security/advisories/GHSA-6cc8-p5mm-29w2
[2] https://tukaani.org/xz/xz-cve-2025-31115.patch

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-05-14 14:44:37 +02:00