mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-10-21 16:32:45 -09:00
Code Issues Packages Projects Releases Wiki Activity
83,945 Commits 6 Branches 485 Tags
cdddb871d385ef0549819d1dbcffd24a58277181
Commit Graph

83945 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Bernd Kuhls
cdddb871d3 package/vlc: security bump to version 3.0.24 
https://code.videolan.org/videolan/vlc/-/blob/3.0.24/NEWS
https://code.videolan.org/videolan/vlc/-/tags/3.0.24

https://www.videolan.org/vlc/releases/3.0.24.html
"Over 130 security fixes across VLC and its bundled libraries"

https://www.videolan.org/security/sb-vlc3024.html
"VLC 3.0.24 fixes over 50 security issues in VLC itself."

Upstream removed unmaintainted libschroediner library:
614914f7bb

Upstream removed support for mfx, which was disabled in buildroot, and
replaced it with optional support for libvpl:
dcd1e9f447

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2026-10-05 13:13:00 +02:00
Bernd Kuhls
3b3f1d6d9d package/tzdata: bump version to 2026e 
https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/VXIA4AU73OQL3OZ3ZBZHWIASIIVBGUJV/
https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/L4IGHJRBUQR53F7RTEHM5IS7ZMBR3YXP/
https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/NVHSX2PAQIT44U5FCCEVNJJYXQMMTJSA/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2026-10-05 13:09:47 +02:00
Bernd Kuhls
57ed2d0d68 package/hwdata: bump version to 0.412 
https://github.com/vcrhonek/hwdata/releases/tag/v0.412

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2026-10-05 13:09:37 +02:00
Bernd Kuhls
c29ff5b9b3 package/gnupg2: bump version to 2.5.24 
https://lists.gnupg.org/pipermail/gnupg-announce/2026q3/000516.html
"Note that version 2.5.23 was released yesterday but had a regression
 in the smartcard detection code; which is fixed by this release."

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-10-04 21:31:36 +02:00
Bernd Kuhls
8692b78942 package/ccache: bump version to 4.14.1 
https://ccache.dev/releasenotes.html#_ccache_4_14.1

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-10-04 21:09:47 +02:00
Fengwei Tan
a7d47860f3 package/btop: new package 
Btop++ is a resource monitor that shows usage and stats for processor,
memory, disks, network and processes.

https://github.com/aristocratos/btop

Signed-off-by: Fengwei Tan <tfx2001@outlook.com>
[Julien: move the "v" from _VERSION to _SITE]
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-10-04 21:05:49 +02:00
Bernd Kuhls
cb129a641b package/iperf3: security bump version to 3.22 
https://github.com/esnet/iperf/blob/3.22/RELNOTES.md

Fixes CVE-2026-101283, CVE-2026-101276, CVE-2026-102253, CVE-2026-71217.

"The iperf-3.18 release notes were updated to reflect that a code change
 in that version addresses CVE-2026-71218."

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2026-10-04 18:13:22 +02:00
Bernd Kuhls
5feefc6be0 package/libheif: security bump version to 1.23.5 
https://github.com/strukturag/libheif/releases/tag/v1.23.5

Fixes the following CVEs:

(CVE numbers will be added when assigned.)

CVE-2026-XXXXX (GHSA-v8qw-hwjv-44hw)
CVE-2026-XXXXX (GHSA-qwpf-5wf7-r996)
CVE-2026-XXXXX (GHSA-9c75-9g8r-4728)
CVE-2026-XXXXX (GHSA-r7gr-2xm2-23wf)
CVE-2026-XXXXX (GHSA-q492-cfcm-895h)

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2026-10-04 18:12:47 +02:00
James Hilliard
b12c9294ff package/python-urwid: bump to version 4.2.4 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-04 18:03:17 +02:00
James Hilliard
3e6f6cec20 package/python-sqlalchemy: bump to version 2.1.3 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-04 18:03:15 +02:00
James Hilliard
51de4cb8aa package/python-simplejson: bump to version 4.2.0 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-04 18:03:13 +02:00
James Hilliard
5914a445d9 package/python-selenium: bump to version 4.50.0 
Update license hash due to copyright year update:
fbd3b6de2f

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-04 18:03:10 +02:00
James Hilliard
a398dc7a54 package/python-ruamel-yaml: bump to version 0.19.1 
Update license hash due to copyright year update:
6846cf136e/

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-04 18:03:07 +02:00
James Hilliard
dd7096fbbd package/python-regex: bump to version 2026.9.29 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-04 18:03:03 +02:00
James Hilliard
74df9b3646 package/python-pyspnego: bump to version 0.12.3 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-04 18:03:00 +02:00
James Hilliard
b46eec503e package/python-pysnmp: bump to version 7.1.30 
Update license hash due to copyright year update:
fc678e5419

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-04 18:02:57 +02:00
James Hilliard
89d113bf6c package/python-proto-plus: bump to version 1.29.0 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-04 18:02:55 +02:00
James Hilliard
28dc0c3ec1 package/python-msgpack: bump to version 1.2.3 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-04 18:02:51 +02:00
James Hilliard
933507e0d9 package/python-lmdb: bump to version 3.0.0 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-04 17:57:29 +02:00
James Hilliard
6738864261 package/python-jaraco-functools: bump to version 4.6.0 
Update license hash due to the copyright year inserted by
coherent.licensed:
3b3a6b658d

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-04 17:57:27 +02:00
James Hilliard
a42589856a package/python-meson-python: bump to version 0.22.1 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-04 17:57:25 +02:00
James Hilliard
1f885a61a1 package/python-jaraco-context: bump to version 6.1.2 
Update license hash due to the copyright year inserted by
coherent.licensed:
3b3a6b658d

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-04 17:57:23 +02:00
James Hilliard
78aa2802a4 package/python-google-auth: bump to version 2.59.1 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-04 17:57:21 +02:00
James Hilliard
c9293e3ef1 package/python-googleapis-common-protos: bump to version 1.75.5 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-04 17:57:19 +02:00
James Hilliard
aaeac510a1 package/python-fonttools: bump to version 4.66.1 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-04 17:57:17 +02:00
James Hilliard
28fe8d9103 package/python-falcon: bump to version 4.4.0 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-04 17:57:15 +02:00
James Hilliard
86b7c0c0a6 package/python-filelock: bump to version 4.0.9 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-04 17:57:13 +02:00
James Hilliard
906b5bd589 package/{python-}protobuf: bump to version 36.2 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-04 17:57:11 +02:00
Peter Seiderer
42c3ecb293 package/dhcpcd: fix check-package warnings in S41dhcpcd 
Update S41dhcpcd:

- use plain "dhcpcd" for DAEMON (instead of "/sbin/dhcpcd"), adjust
  PIDFILE accordingly and while at it use quotation marks for variable
  definitions
- fix indent (tabs vs. spaces)

Fixes:

  $ ./utils/check-package package/dhcpcd/*
  package/dhcpcd/S41dhcpcd:6: Do not include path in DAEMON (https://nightly.buildroot.org/#adding-packages-start-script)
  package/dhcpcd/S41dhcpcd:8: Incorrect PIDFILE value  (https://nightly.buildroot.org/#adding-packages-start-script)
  package/dhcpcd/S41dhcpcd:13: should be indented with tabs (https://nightly.buildroot.org/#adding-packages-start-script)
  package/dhcpcd/S41dhcpcd:17: should be indented with tabs (https://nightly.buildroot.org/#adding-packages-start-script)
  package/dhcpcd/S41dhcpcd:21: should be indented with tabs (https://nightly.buildroot.org/#adding-packages-start-script)
  package/dhcpcd/S41dhcpcd:25: should be indented with tabs (https://nightly.buildroot.org/#adding-packages-start-script)
  package/dhcpcd/S41dhcpcd:30: should be indented with tabs (https://nightly.buildroot.org/#adding-packages-start-script)

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-04 17:54:34 +02:00
Bernd Kuhls
ab2c029070 package/thrift: security bump version to 0.25.0 
https://github.com/apache/thrift/blob/v0.25.0/CHANGES.md
https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1

Removed patch 0001 which is included in this release.

Updated license hash due to upstream commit
df376589a8

Quoting https://seclists.org/oss-sec/2026/q4/38:

"It fixes the 61 vulnerabilities listed below.
[...]
Each entry gives the CVSS 4.0 score, the ASF rating, the title, the
affected language bindings and a link to the full announcement (severity
vector, weakness, description and credit). The CVE records are at
https://www.cve.org/CVERecord?id=<CVE id>.

CVE-2026-61373  8.7  important Java TSaslNonblockingServer pre-auth
                               unbounded SASL frame allocation
                               Bindings: Java
 https://lists.apache.org/thread/shy1rrm2g383wlbdb2p7w19c868ntdjp

CVE-2026-61374  7.1  important Java TSaslTransport post-auth data-frame
                               missing size limit
                               Bindings: Java
 https://lists.apache.org/thread/35831rngzrqky1gvc32t06psgq1b8441

CVE-2026-63772  8.7  important Unauthenticated single-packet crash of Go
                               Thrift servers via the THeader transform
                               count
                               Bindings: Go
 https://lists.apache.org/thread/6kpzdw29gsfxptv4b65y9s6f42tdyo8k

CVE-2026-66054  6.9  moderate  C++ THeaderTransport does not enforce
                               configured maxFrameSize
                               Bindings: C++
 https://lists.apache.org/thread/7c23sgowkb3ssmolqofqsn8wzsddvf33

CVE-2026-66055  8.2  important TJSONProtocol accepts a single JSON
                               string/number exceeding the configured size
                               limit (multi-language)
                               Bindings: C++, Java, Go, netstd, Python,
                                 Delphi
 https://lists.apache.org/thread/nxlmlhgsh7fwr4mo1fkhtkw3v266qhcx

CVE-2026-66081  8.7  important c_glib read_message_begin leaves output
                               parameters unset for non-versioned messages
                               Bindings: c_glib
 https://lists.apache.org/thread/9d51ygo6hrsdo5ndwckbwt3mnp290m57

CVE-2026-66331  6.9  moderate  Buffered transport reads are not accounted
                               against MaxMessageSize
                               Bindings: Delphi
 https://lists.apache.org/thread/971572orz86jdwlg58wqv8o50oqqb143

CVE-2026-66837  8.7  important PHP accelerator sizes a stack buffer from a
                               wire-controlled string length
                               Bindings: PHP
 https://lists.apache.org/thread/7o985t84551tpo55v6fsd3g42gs3zps1

CVE-2026-66858  8.7  important skip() does not apply the recursion limit
                               (Python accelerator, PHP, Perl, Lua,
                               Smalltalk, OCaml)
                               Bindings: Python, PHP, Perl, Lua, Smalltalk,
                                 OCaml
 https://lists.apache.org/thread/6kl6g40tpl8zt3opd8fwn6bsgyddzhd5

CVE-2026-66859  8.7  important c_glib multiplexed processor crashes on a
                               message it cannot route
                               Bindings: c_glib
 https://lists.apache.org/thread/n9rogg2166hl9y4ycq5njpvnxndr8y5o

CVE-2026-82458  8.7  important Container element count not bounded by the
                               bytes available
                               Bindings: Go, Rust, netstd, OCaml, Erlang,
                                 JavaME, C++, Java, Kotlin, D
 https://lists.apache.org/thread/7xqf651pvjykw0xr9vw0ooz0bwx7wzy7

CVE-2026-82459  8.2  important Integer underflow in C++ THeaderTransport
                               allows an unauthenticated remote peer to
                               terminate a 32-bit process
                               Bindings: C++
 https://lists.apache.org/thread/zf8ppfpl6nqhp53sxnz6osnjw93g9fw2

CVE-2026-83632  9.2  critical  C++ THttpTransport grows its line buffer
                               without bound
                               Bindings: C++
 https://lists.apache.org/thread/zjv6hjmhl4tb4l4l1dk4bmc2whxh0lb4

CVE-2026-83663  8.7  important TFramedTransport and THeaderTransport
                               re-enter Read once per frame that carries no
                               payload (Go)
                               Bindings: Go
 https://lists.apache.org/thread/yjz317wq7h86q9k8ws6ton0ojgl8hjct

CVE-2026-83745  8.7  important WebSocket frame decoders allocate the payload
                               buffer from the declared length, not the
                               bytes received (Node.js, D)
                               Bindings: Node.js, D
 https://lists.apache.org/thread/64y7f0b89mnq4xoqcn4h26to8kskolgc

CVE-2026-85086  6.9  moderate  Perl TLS client disables certificate
                               verification by default
                               Bindings: Perl
 https://lists.apache.org/thread/c7f9g4027ok0gocyso2y84r2mhgc2xmy

CVE-2026-85087  6.9  moderate  Python ≥3.12 host-name check silently becomes
                               a no-op
                               Bindings: Python
 https://lists.apache.org/thread/l2rgp3dqhpy2w347forzdt9g7o2d6k0d

CVE-2026-85088  6.9  moderate  The C++ and D clients fall back to the
                               certificate Common Name when subjectAltName
                               entries are present but do not match
                               Bindings: C++, D
 https://lists.apache.org/thread/zcgm7lx6037lvgvn87rc1tj3p0zhv371

CVE-2026-85476  8.2  important c_glib `read_all` spins when the underlying
                               read returns 0
                               Bindings: c_glib
 https://lists.apache.org/thread/1zdvscq7p3hf3z30s26h4tm9dvljm1jj

CVE-2026-85483  6.3  moderate  c_glib TZlibTransport reports a full read
                               after a premature stream end
                               Bindings: c_glib
 https://lists.apache.org/thread/ro1y0ckzfzcc45yk9qkt1p6t4g2jvrfy

CVE-2026-85493  8.7  important TProtocolUtil.skip follows peer-chosen
                               nesting to any depth the stack allows (Dart,
                               Java ME)
                               Bindings: Dart, JavaME
 https://lists.apache.org/thread/oqr0h2k1cg9hho3oh8trmovmxc04fl5m

CVE-2026-85494  8.7  important Framed transport and binary protocol size a
                               read buffer from a peer-declared length with
                               no effective maximum (multi-language)
                               Bindings: Python, Ruby, Erlang, Lua, Dart,
                                 JavaME, D, Perl, PHP
 https://lists.apache.org/thread/rm0m34gt6fh1flvt16wty559hfg191qr

CVE-2026-86535  8.7  important A JSON member name can stall the Node
                               server's event loop indefinitely
                               Bindings: Node.js
 https://lists.apache.org/thread/94cvvzzl0rh707bn2j4zt844v547508g

CVE-2026-86536  6.3  moderate  A map key from the wire can replace a decoded
                               object's prototype in generated JavaScript
                               Bindings: Node.js, JavaScript, TypeScript
 https://lists.apache.org/thread/xckvfky30kdnk8vqnhy0wndthvc9nymp

CVE-2026-86537  8.7  important A truncated HTTP request stops the D

                               library's server, allowing an unauthenticated

                               remote attacker to deny service
                               Bindings: D
 https://lists.apache.org/thread/k14jfr1xwc0vtmm2s7xro6lt7q4y6s7m

CVE-2026-87117  8.7  important PHP `thrift_protocol` accelerator

                               dereferences a missing container-element spec

                               Bindings: PHP
 https://lists.apache.org/thread/y05tvpv19ow44j16gtbcy9ht7lb0qjpy

CVE-2026-90440  8.2  important An exception escaping a libevent callback
                               stops the D library's non-blocking server,
                               allowing an unauthenticated remote attacker
                               to deny service
                               Bindings: D
 https://lists.apache.org/thread/s8fjltl6c1pkm7vg9v4qkr89b5b74jbg

CVE-2026-91135  9.2  critical  C++ `THeaderTransport::transform()` heap
                               buffer overflow (write direction)
                               Bindings: C++
 https://lists.apache.org/thread/rbpwlhlxnv2qgyk8cfscp2d2fd3p0ojb

CVE-2026-91137  8.7  important PHP `thrift_protocol` accelerator: zero-byte
                               container elements
                               Bindings: PHP
 https://lists.apache.org/thread/bf12g1b11r4x9x3wsy4mgwfgd0t779h7

CVE-2026-92834  6.3  moderate  C++ WebSocket server transport does not read
                               a full request length
                               Bindings: C++
 https://lists.apache.org/thread/bjor9ttx7hk23gzcx60ohz0f20xzvgv0

CVE-2026-93925  8.7  important C++ `THeaderTransport::writeVarint32()` stack
                               buffer overflow on a negative protocol id
                               Bindings: C++
 https://lists.apache.org/thread/b4rrkrwoyqb9g7hk58d3fx09cbvp1tg9

CVE-2026-93926  8.7  important C++ `THeaderTransport::untransform()` leaks
                               the zlib stream on the error path
                               Bindings: C++
 https://lists.apache.org/thread/9353rb8mpoq4ltff88h1j2y3hfy6blgb

CVE-2026-94633  8.7  important Dart `TBinaryProtocol.readMessageBegin`
                               allocates from the pre-versioned name length
                               Bindings: Dart
 https://lists.apache.org/thread/cxkbblyht7988p2o6yvnmd6536qmt88k

CVE-2026-94634  8.2  important Python `TJSONProtocol` has a string length
                               limit that is off by default
                               Bindings: Python
 https://lists.apache.org/thread/dgy8ox9t4bh1xhf74ovf29ht87x7dno4

CVE-2026-94635  8.7  important Lua `TBinaryProtocol:readMessageBegin`
                               bypasses `checkStringSize` on the
                               pre-versioned name
                               Bindings: Lua
 https://lists.apache.org/thread/ow8994gb5g8ssmmbkbl48xqb0tpvqyr3

CVE-2026-94636  8.2  important Python `TZlibTransport` stops enforcing its
                               decompressed-size limit once the limit is
                               exactly used up
                               Bindings: Python
 https://lists.apache.org/thread/1rpq0d0g6yzjjzl1z27lwmvhzkn6rbrs

CVE-2026-94637  8.2  important Go `THeaderTransport` does not bound the
                               inflated size of a ZLIB frame
                               Bindings: Go
 https://lists.apache.org/thread/6hxll1jcnod9gfr225tz7my08lpj3jmt

CVE-2026-94638  6.3  moderate  PHP `thrift_protocol` C extension ignores the
                               configured `maxStringSize`
                               Bindings: PHP
 https://lists.apache.org/thread/v60w786pqr7njzz9425grby8yjrgmbsj

CVE-2026-94639  8.2  important Java `TSaslNonblockingServer`: residual of
                               CVE-2026-61373 (thread-death black hole + no
                               cross-connection budget)
                               Bindings: Java
 https://lists.apache.org/thread/5okpz47dv8hy0s3r6tmrplg3y7jzhhyw

CVE-2026-94642  8.7  important PHP `TSimpleServer` exits the whole process
                               on any non-transport exception
                               Bindings: PHP
 https://lists.apache.org/thread/5tjwbbyympbj16lblocv9b12s32sg113

CVE-2026-94644  8.2  important PHP `TJSONProtocol` string/number readers
                               have no size bound
                               Bindings: PHP
 https://lists.apache.org/thread/8y04vvxw7ozxxh3c44vhoy7jsd6bonzq

CVE-2026-94645  8.2  important Node.js `TJSONProtocol` uses a peer-declared
                               container size as an unbounded loop bound
                               Bindings: Node.js
 https://lists.apache.org/thread/p96mokqfy16mnqfyon46mf6g8nr9ghb6

CVE-2026-94646  8.7  important Node.js `server.js` ends the process on any
                               per-connection error (+ two triggers)
                               Bindings: Node.js
 https://lists.apache.org/thread/5hjh0gz8wf6bo7ydxjpqj92m42hwmfo8

CVE-2026-94648  8.2  important dart `TJsonProtocol`/`TJSONProtocol` has no
                               string size bound
                               Bindings: Dart
 https://lists.apache.org/thread/f9w4q6ttlc3k9404x4do25gdhqodtjnn

CVE-2026-94650  8.2  important c_glib generated struct readers have no
                               recursion-depth guard (native stack
                               exhaustion)
                               Bindings: c_glib
 https://lists.apache.org/thread/poskkt3p754b2f293g63934hw160o86j

CVE-2026-94651  8.2  important Java `TSaslNonblockingServer`
                               `Computation.run` orphans a connection on a
                               pre-auth parse error
                               Bindings: Java
 https://lists.apache.org/thread/rflzpdvtk8yhpzg99wkf5yf277nn7267

CVE-2026-94652  6.3  moderate  C++ `TEvhttpServer` leaks its
                               `RequestContext` when the processor throws
                               before calling back
                               Bindings: C++
 https://lists.apache.org/thread/nodwz7gjvogkkh3w1jwbsslk1c7t0727

CVE-2026-94653  8.2  important PHP framed/memory/HTTP transports re-slice
                               the buffer on every read (quadratic)
                               Bindings: PHP
 https://lists.apache.org/thread/8zbv1y4wzr3nn5mzmdph7b0n6tm0lc4m

CVE-2026-94654  8.2  important Python `TNonblockingServer` busy-loops and
                               stops selecting all fds after an
                               8192-byte-boundary frame
                               Bindings: Python
 https://lists.apache.org/thread/kx3xdttoypl8j4dcxmqbq9dwy1w0kr7j

CVE-2026-94655  8.2  important Lua `TJsonProtocol` string/number readers
                               have no size bound and are quadratic
                               Bindings: Lua
 https://lists.apache.org/thread/wdjyf4y115ybgdzz5m3gspo97lcmz1dt

CVE-2026-94656  8.2  important rb `TJsonProtocol`/`TJSONProtocol` has no
                               string size bound
                               Bindings: Ruby
 https://lists.apache.org/thread/lg97w2yvg3c6z06l8m5xs3j3v2m6mvj8

CVE-2026-94657  8.2  important javame `TJsonProtocol`/`TJSONProtocol` has no
                               string size bound
                               Bindings: JavaME
 https://lists.apache.org/thread/lpcmo2xjfyfww474xdyyfypkqthk9s14

CVE-2026-94658  8.7  important Lua `TFramedTransport`/`THttpTransport`

                               re-slice the buffer on every read (quadratic)

                               Bindings: Lua
 https://lists.apache.org/thread/hv6b1nyk2p15gy5pmtprwo7z9m46mfcx

CVE-2026-96277  8.7  important Ruby `SimpleServer` ends `serve()` on any
                               non-Transport/Protocol exception
                               Bindings: Ruby
 https://lists.apache.org/thread/k1t5r9sz7k5tn57cnf5khw2ywlxv6098

CVE-2026-96286  8.2  important Perl servers end `serve()` when serving one
                               connection fails
                               Bindings: Perl
 https://lists.apache.org/thread/o5386v7ytbbjv9sx7dbszw46ypod5yd9

CVE-2026-96287  8.2  important Perl `FramedTransport` reads and TLS socket

                               writes re-slice the remaining buffer on every

                               call (quadratic)
                               Bindings: Perl
 https://lists.apache.org/thread/tcg16jr59z5nry066dw7ym60vl25dxt9

CVE-2026-96288  8.2  important Erlang generated struct reads have no
                               recursion-depth guard (unbounded memory)
                               Bindings: Erlang
 https://lists.apache.org/thread/vxnk7cmdtoqjn97b8szlqym1mxx0xtzb

CVE-2026-96289  8.2  important php `--gen php:inlined` struct readers (and
                               `TProtocol::skipBinary`) have no
                               recursion-depth guard
                               Bindings: PHP
 https://lists.apache.org/thread/kv1zkwlt82lkkv20g29txr5pjnvo0pf8

CVE-2026-96292  8.2  important Lua `THttpTransport:_parseHeaders` matches
                               each header line with a backtracking pattern
                               (quadratic)
                               Bindings: Lua
 https://lists.apache.org/thread/3wmvtvv56rky5wtszn4zr8w12kg928qn

CVE-2026-96294  8.7  important nodejs web server: no `error` listener on an
                               upgraded WebSocket connection
                               Bindings: Node.js
 https://lists.apache.org/thread/52gwhsy947hj9qhgn0dql726z1q927g4

CVE-2026-96990  8.2  important Erlang thrift_json_protocol reads a whole
                               message with no size bound
                               Bindings: Erlang
 https://lists.apache.org/thread/hrgcqlms4ksrz4qkqdjwoxxggdty7dgh

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-04 17:51:13 +02:00
Waldemar Brodkorb
73761afe0f package/valgrind: bump to 3.27.1 
See here for a ChangeLog:
https://valgrind.org/docs/manual/dist.news.html

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-04 17:44:16 +02:00
Vincent Jardin
722647d5ab package/aer-inject: bump version to 36d5b4f 
Drop 0001-libgen-basename.patch, applied upstream, see commit 197f51d.

Upstream now ships a LICENSE file (see commit 41cda6d).

Changelog:
9bd5e2c788...36d5b4f59b

Tested with Buildroot's GitLab CI (test-pkg on all toolchains):
https://gitlab.com/vjardin/buildroot/-/pipelines/2909708410

Signed-off-by: Vincent Jardin <vjardin@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-04 09:27:21 +02:00
Bernd Kuhls
fca0899dd6 package/mpg123: remove MMU dependency 
Buildroot commit f0862592b3 added the
dependency to BR2_USE_MMU in 2014.

Upstream made fork() optional in 2022:
91f75fc026

This change reveals a previously hidden build error with the toolchain
bootlin-armv7m-uclibc:

src/libmpg123/synth_arm_accurate.S: Assembler messages:
src/libmpg123/synth_arm_accurate.S:22: Error: selected processor does
 not support ARM opcodes
src/libmpg123/synth_arm_accurate.S:31: Error: attempt to use an ARM
 instruction on a Thumb-only processor --
 `stmfd sp!,{r4,r5,r6,r7,r8,r9,r10,r11,lr}'
src/libmpg123/synth_arm_accurate.S:33: Error: attempt to use an ARM
 instruction on a Thumb-only processor -- `add r0,r0,#64'
[...]

To fix the problem we limit ARM code to BR2_ARM_CPU_HAS_ARM.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-04 09:04:43 +02:00
TIAN Yuanhao
569b91bada package/chrony: switch chrony.service to Type=notify 
Since 4.7, chronyd implements the systemd notify protocol natively
(upstream commit cb11184, "main: add support for systemd
notification"): it sends READY=1 to $NOTIFY_SOCKET once fully
initialised and ready to accept commands.

Type=simple cannot observe that signal. systemd marks the unit active
as soon as the process starts, before chronyd is ready, and gpsd may
follow immediately: its drop-in br-chrony.conf orders it only with
After=chrony.service.

Switch to Type=notify so the ordering holds. chronyd's -n mode
(don't detach) suits Type=notify, and no libsystemd dependency
is added.

Fixes: 6c80b71c8c ("package/chrony: bump to version 4.7")
Cc: Bernd Kuhls <bernd@kuhls.net>
Cc: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Cc: Scott Fan <fancp2007@gmail.com>
Cc: Yann E. MORIN <yann.morin@orange.com>
Signed-off-by: TIAN Yuanhao <tianyuanhao3@163.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-03 20:39:47 +02:00
Bjørn Damstedt Rasmussen
b174bfd0b2 package/openjdk-bin: add proper CPE ID information 
The CPE ID on openjdk version 21.0.2 in NVD:
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:oracle:openjdk:21.0.2:*:*:*:*:*:*:*

HOST_OPENJDK_BIN_CPE_ID_VERSION has be overwritten to match NVD's
versioning.

Signed-off-by: Bjørn Damstedt Rasmussen <contact@bearware.dk>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-03 20:37:52 +02:00
Yegor Yefremov
9722f61382 package/swig: also create a swig4.0 symlink 
FindSWIG in CMake searches for swig4.0, swig3.0 and swig2.0 before it
tries plain swig, and it searches the whole PATH for one name before
moving on to the next. We only create swig3.0 and swig$(SWIG_VERSION_MAJOR)
(swig4.5) symlinks in $(HOST_DIR)/bin, so a swig4.0 installed on the
build machine, as Ubuntu 22.04 does with its swig4.0 package, takes
precedence over our host-swig for every CMake package that does not pass
SWIG_EXECUTABLE explicitly. With CMake 3.22.1, libftdi1 with Python
bindings ends up with

  -- Found SWIG: /usr/bin/swig4.0 (found suitable version "4.0.2", ...)

Also create a swig4.0 symlink, and update the comment accordingly.

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Assisted-by: Claude:claude-opus-5
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-03 19:50:47 +02:00
Bjørn Damstedt Rasmussen
875cc7bbf1 package/openjdk: CPE ID for openjdk 
The CPE ID on version 21.0.2 in NVD:
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:oracle:openjdk:21.0.2:*:*:*:*:*:*:*

The automatically generated OPENJDK_CPE_ID_VERSION cannot be used
because OPENJDK_VERSION includes a '+', e.g. "21.0.2+10". NVD will not
accept a version number with '+'.

Signed-off-by: Bjørn Damstedt Rasmussen <contact@bearware.dk>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-03 19:46:52 +02:00
Bjørn Damstedt Rasmussen
3010c801e3 package/setserial: CPE ID for setserial 
This is a valid CPE ID:
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:setserial_project:setserial:2.17:*

Signed-off-by: Bjørn Damstedt Rasmussen <contact@bearware.dk>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-03 19:45:53 +02:00
Shubham Chakraborty
21e040e7f9 package/screenfetch: bump to version 3.9.9 
Drop patch that is included in upstream's 3.9.9 release.

Signed-off-by: Shubham Chakraborty <chakrabortyshubham66@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-03 19:38:51 +02:00
Julien Olivain
6d9b839647 package/acpica: bump to version 20260930 
For change log since 2025121, see [1] and [2].

The Github project URL [3] now redirects to [4]. The CONTRIBUTE.md
file was added in commit [5] which mention this new URL. This
commit updates ACPICA_SITE accordingly.

Upstream commit [6] (included in this 20260930 release) added
actual license files. In previous versions, Buildroot was using
the source/include/acpi.h header files which was including license
terms. This commit updates ACPICA_LICENSE_FILES to use those new
license files. Note: the license terms are not changed, so
ACPICA_LICENSE is not updated.

[1] https://github.com/open-acpica/acpica/releases/tag/20260930
[2] https://github.com/open-acpica/acpica/releases/tag/20260408
[3] https://github.com/acpica/acpica
[4] https://github.com/open-acpica/acpica
[5] 0d90f9616a
[6] 58b9cab48f

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-03 19:35:44 +02:00
Dario Binacchi
e493982138 package/libgphoto2: drop autoreconf 
Commit 8b05934511 ("package/libgphoto2: bump to version 2.5.34")
removed the patch touching the autoconf macros, but left behind the
comment referring to it and LIBGPHOTO2_AUTORECONF = YES. The release
tarball ships a regenerated configure script that already includes the
jpeg_mem_dest size type check, so autoreconf is no longer needed.

Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-03 19:34:57 +02:00
Sebastian Michel
084bfa6e6d package/python-servestatic: new package 
Added package for ServeStatic, version 4.3.2.
https://github.com/Archmonger/ServeStatic

Added a runtime test that verifies static-file responses through both
the WSGI and ASGI interfaces. Also verified that the installed
servestatic command-line entry point starts successfully.

Signed-off-by: Sebastian Michel <sebastian.michel@oss.othermo.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-03 19:34:21 +02:00
Bernd Kuhls
b524480bde {linux, linux-headers}: bump 7.2.x, 6.18.x, 6.12.x, 6.6.x, 6.1.x, 5.15.x, 5.10.x series 
Update the latest kernel releases to:
 - 7.2.8 -> 7.2.9
 - 6.18.54 -> 6.18.55
 - 6.12.111 -> 6.12.112
 - 6.6.157 -> 6.6.158
 - 6.1.188 -> 6.1.189
 - 5.15.221 -> 5.15.222
 - 5.10.270 -> 5.10.271

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-10-03 19:11:29 +02:00
Fiona Klute
18f6446b4f package/libseccomp: security bump to version 2.6.1 
The upstream changelog [1] lists three security fixes (without CVEs):

* Incorrect 64-bit comparison merge in libseccomp can weaken seccomp filters
  https://github.com/seccomp/libseccomp/security/advisories/GHSA-4q85-33p6-j5g6

* Oversized seccomp filters can trigger libseccomp double free
  https://github.com/seccomp/libseccomp/security/advisories/GHSA-46fr-jh49-xvhx

* Oversized seccomp filters can trigger libseccomp heap corruption
  https://github.com/seccomp/libseccomp/security/advisories/GHSA-2hqh-5c36-grrm

[1] https://github.com/seccomp/libseccomp/releases/tag/v2.6.1

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-10-03 18:37:35 +02:00
TIAN Yuanhao
079f168792 package/chrony: add 50-chrony.list for systemd-timedated 
systemd-timedated discovers NTP services from ntp-units.d/*.list.
Buildroot's chrony package never installs one: on a systemd image
without timesyncd, 'timedatectl status' reports

    NTP service: n/a

and 'timedatectl set-ntp on' fails with

    Failed to set ntp: NTP not supported

even though chronyd is running.

Install 50-chrony.list, following the convention set by Debian,
Fedora and Arch, so timedatectl can manage chrony.

Cc: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Cc: Peter Korsgaard <peter@korsgaard.com>
Cc: Scott Fan <fancp2007@gmail.com>
Signed-off-by: TIAN Yuanhao <tianyuanhao3@163.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-03 18:35:02 +02:00
Florian Larysch
6c9c2b71e6 linux: fix pahole discovery when BR2_LINUX_KERNEL_NEEDS_HOST_PAHOLE 
Around Linux 5.11, upstream started introducing checks that execute
"pahole --version" for feature discovery (e.g. [1]).

However, when building with BR2_LINUX_KERNEL_NEEDS_HOST_PAHOLE Buildroot
only lists host-pahole in LINUX_DEPENDENCIES, so it isn't available for
the configure step when using BR2_PER_PACKAGE_DIRECTORIES. This results
in the host pahole being used (resulting in host-dependent behavior), or
no pahole being detected at all when the build host doesn't have it
(which will then disable Kconfig options that require it).

Fix this by adding host-pahole to LINUX_KCONFIG_DEPENDENCIES.

A similar issue occurs when running "make linux-menuconfig" and friends
because PATH deliberately gets stripped when pkg-kconfig.mk builds
x_CONFIGURATOR_MAKE_ENV. Explicitly pass the pahole path to fix this.

[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?h=5f9ae91f7c0dbbc4195e2a6c8eedcaeb5b9e4cbb

Signed-off-by: Florian Larysch <fl@n621.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-03 18:30:39 +02:00
Fiona Klute (othermo GmbH)
b1990243ca package/e2fsprogs: enable libarchive for host package 
mke2fs need libarchive to populate a newly created filesystem from a
tarball with "-d tarball|-". Enable it in HOST_E2FSPROGS_CONF_OPTS,
and add a dependency on host-libarchive.

Signed-off-by: Fiona Klute (othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-03 18:29:23 +02:00
Peter Seiderer
4e6cd0c615 package/coreutils: bump version to 6.12 
- bump version to 6.12 (for details see [1] and [2])
- remove 'utils_cv_localtime_cache' configure option as removed with
  upstream commit [3]

[1] https://lists.gnu.org/archive/html/coreutils-announce/2026-04/msg00000.html
[2] https://lists.gnu.org/archive/html/coreutils-announce/2026-09/msg00000.html
[3] https://cgit.git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b64f9bfe4fd4ce5d276626fd149af2a625b6d434

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-03 18:24:42 +02:00
Peter Seiderer
f6c2c6a086 package/eudev: bump version to 3.2.15 
- bump version to 3.2.15 (for details see [1])
- move group 'render' back from systemd to common udev (see [1] and [2])

[1] https://github.com/eudev-project/eudev/releases/tag/v3.2.15
[2] dbfd300297

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-03 18:17:17 +02:00
Fiona Klute (othermo GmbH)
7ed738bf5d package/gnu-efi: fix license information 
Split the confusing "and/or" for gnulib, so dual-licensed and GPL-only
parts are clearly noted, and add the missing LGPL license. Lines in
GNU_EFI_LICENSE are ordered the same way as the information is given
in the LICENSE file.

The license situation of inc/subst/elf.h is curious: The file itself
is licensed under LGPL-2.1-or-later, and used in gnu-efi under
LGPL-3.0-or-later (accompanied by the appropriate license files),
which in turn allows using it for object code under different terms
with certain conditions (see section 3 of LGPL 3.0, as noted in the
gnu-efi LICENSE file).

Signed-off-by: Fiona Klute (othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2026-10-03 18:16:36 +02:00