Commit Graph

78621 Commits

Author SHA1 Message Date
Francois Perrad
d16be5cbc2 package/4th: switch to https
Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 033fc7ca8f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-10-16 09:57:38 +02:00
Peter Korsgaard
be6504cecb board/beagleboneai/post-build.sh: fix shellcheck issues
BOARD_DIR is not used, so drop it and quote $BINARIES_DIR to make shellcheck
happy.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 5f620e144d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-10-16 09:57:28 +02:00
Peter Korsgaard
f015c3882a configs/beagleboneai: switch to Bootlin glibc stable toolchain
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 331d80f52e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-10-16 09:57:15 +02:00
Titouan Christophe
3f471c3040 package/erlang: security bump to v26.2.5.15
See the release notes on
https://github.com/erlang/otp/releases?q=OTP-26.&expanded=true

Also, remove patch that is now applied upstream

This fixes the following vulnerabilities:
- CVE-2024-53846:
    OTP is a set of Erlang libraries, which consists of the Erlang runtime
    system, a number of ready-to-use components mainly written in Erlang,
    and a set of design principles for Erlang programs. A regression was
    introduced into the ssl application of OTP starting at OTP-25.3.2.8,
    OTP-26.2, and OTP-27.0, resulting in a server or client verifying the
    peer when incorrect extended key usage is presented (i.e., a server
    will verify a client if they have server auth ext key usage and vice
    versa).
    https://www.cve.org/CVERecord?id=CVE-2024-53846

- CVE-2025-4748:
    Improper Limitation of a Pathname to a Restricted Directory ('Path
    Traversal') vulnerability in Erlang OTP (stdlib modules) allows
    Absolute Path Traversal, File Manipulation. This vulnerability is
    associated with program files lib/stdlib/src/zip.erl and program
    routines zip:unzip/1, zip:unzip/2, zip:extract/1, zip:extract/2 unless
    the memory option is passed.  This issue affects OTP from OTP 17.0
    until OTP 28.0.1, OTP 27.3.4.1 and OTP 26.2.5.13, corresponding to
    stdlib from 2.0 until 7.0.1, 6.2.2.1 and 5.2.3.4.
    https://www.cve.org/CVERecord?id=CVE-2025-4748

- CVE-2025-26618:
    Erlang is a programming language and runtime system for building
    massively scalable soft real-time systems with requirements on high
    availability. OTP is a set of Erlang libraries, which consists of the
    Erlang runtime system, a number of ready-to-use components mainly
    written in Erlang. Packet size is not verified properly for SFTP
    packets. As a result when multiple SSH packets (conforming to max SSH
    packet size) are received by ssh, they might be combined into an SFTP
    packet which will exceed the max allowed packet size and potentially
    cause large amount of memory to be allocated. Note that situation
    described above can only happen for successfully authenticated users
    after completing the SSH handshake. This issue has been patched in OTP
    versions 27.2.4, 26.2.5.9, and 25.3.2.18. There are no known
    workarounds for this vulnerability.
    https://www.cve.org/CVERecord?id=CVE-2025-26618

- CVE-2025-30211:
    Erlang/OTP is a set of libraries for the Erlang programming language.
    Prior to versions OTP-27.3.1, 26.2.5.10, and 25.3.2.19, a maliciously
    formed KEX init message can result with high memory usage.
    Implementation does not verify RFC specified limits on algorithm names
    (64 characters) provided in KEX init message. Big KEX init packet may
    lead to inefficient processing of the error data. As a result, large
    amount of memory will be allocated for processing malicious data.
    Versions OTP-27.3.1, OTP-26.2.5.10, and OTP-25.3.2.19 fix the issue.
    Some workarounds are available. One may set option `parallel_login` to
    `false` and/or reduce the `max_sessions` option.
    https://www.cve.org/CVERecord?id=CVE-2025-30211

- CVE-2025-32433:
    Erlang/OTP is a set of libraries for the Erlang programming language.
    Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH
    server may allow an attacker to perform unauthenticated remote code
    execution (RCE). By exploiting a flaw in SSH protocol message
    handling, a malicious actor could gain unauthorized access to affected
    systems and execute arbitrary commands without valid credentials. This
    issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and
    OTP-25.3.2.20. A temporary workaround involves disabling the SSH
    server or to prevent access via firewall rules.
    https://www.cve.org/CVERecord?id=CVE-2025-32433

- CVE-2025-46712:
    Erlang/OTP is a set of libraries for the Erlang programming language.
    In versions prior to OTP-27.3.4 (for OTP-27), OTP-26.2.5.12 (for
    OTP-26), and OTP-25.3.2.21 (for OTP-25), Erlang/OTP SSH fails to
    enforce strict KEX handshake hardening measures by allowing optional
    messages to be exchanged. This allows a Man-in-the-Middle attacker to
    inject these messages in a connection during the handshake. This issue
    has been patched in versions OTP-27.3.4 (for OTP-27), OTP-26.2.5.12
    (for OTP-26), and OTP-25.3.2.21 (for OTP-25).
    https://www.cve.org/CVERecord?id=CVE-2025-46712

- CVE-2025-48038:
    Allocation of Resources Without Limits or Throttling vulnerability in
    Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation,
    Resource Leak Exposure. This vulnerability is associated with program
    files lib/ssh/src/ssh_sftpd.erl.  This issue affects OTP form OTP 17.0
    until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from
    3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.
    https://www.cve.org/CVERecord?id=CVE-2025-48038

- CVE-2025-48039:
    Allocation of Resources Without Limits or Throttling vulnerability in
    Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation,
    Resource Leak Exposure. This vulnerability is associated with program
    files lib/ssh/src/ssh_sftpd.erl.  This issue affects OTP form OTP 17.0
    until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from
    3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.
    https://www.cve.org/CVERecord?id=CVE-2025-48039

- CVE-2025-48040:
    Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh
    (ssh_sftp modules) allows Excessive Allocation, Flooding. This
    vulnerability is associated with program files
    lib/ssh/src/ssh_sftpd.erl.  This issue affects OTP form OTP 17.0 until
    OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1
    until 5.3.3, 5.2.11.3 and 5.1.4.12.
    https://www.cve.org/CVERecord?id=CVE-2025-48040

- CVE-2025-48041:
    Allocation of Resources Without Limits or Throttling vulnerability in
    Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation,
    Flooding. This vulnerability is associated with program files
    lib/ssh/src/ssh_sftpd.erl.  This issue affects OTP form OTP 17.0 until
    OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1
    until 5.3.3, 5.2.11.3 and 5.1.4.12.
    https://www.cve.org/CVERecord?id=CVE-2025-48041

NB: Since Erlang is quite a "large" package, containing the language itself,
some libraries, and some "applications", it's difficult to tell which CVEs
are exactly affecting Buildroot, but it's a good idea to update anyway

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 88f7fed5f2)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-10-16 09:54:44 +02:00
Arnout Vandecappelle
8143b32cb5 Makefile: update for 2025.08.1
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2025.08.1
2025-10-11 23:31:22 +02:00
Titouan Christophe
8d941a2f55 CHANGES: update for 2025.08.1
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2025-10-11 23:30:33 +02:00
Titouan Christophe
60305befad {linux, linux-headers}: bump 6.16.x, 6.12.x, 6.6.x, 6.1.x, 5.15.x, 5.10.x, 5.4.x series
Update the latest kernel releases to:
 - 6.16.9 -> 6.16.11
 - 6.12.49 -> 6.12.51
 - 6.6.108 -> 6.6.110
 - 6.1.154 -> 6.1.155
 - 5.15.193 -> 5.15.194
 - 5.10.244 -> 5.10.245
 - 5.4.299 -> 5.4.300

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-10-09 10:06:38 +02:00
Peter Korsgaard
39abeb5c13 configs/beagleboneai: move to Linux 6.12.50
And adjust the dtb path to the new subdir after commit 724ba6751532 ("ARM:
dts: Move .dts files to vendor sub-directories") in v6.5.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e993272b32)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-10-09 08:47:44 +02:00
Peter Korsgaard
c158bcd4f8 configs/beagleboneai: move to u-boot 2025.04 to unbreak build with gcc 14
With the change to default to gcc 14.x with commit 1e1fafa1f0
("package/gcc: switch to GCC 14.x as the default"), the old u-boot version
no longer builds:

board/ti/am57xx/board.c:948:17: error: implicit declaration of function 'do_cape_detect'; did you mean 'do_board_detect'? [-Wimplicit-function-declaration]

https://gitlab.com/buildroot.org/buildroot/-/jobs/11570241744

So move to u-boot 2025.04 to fix that.  We still need a small patch as
(early) beagleboneai boards do not have the EEPROM (or eMMC partition)
populated, so include the bb.org patch from

0b161f8e89

The new u-boot version needs both openssl and gnutls on the host, so enable
them.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
[Julien: remove patch entry in .checkpackageignore to
  fix check-package error
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 7ec419fb9c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-10-09 08:45:15 +02:00
Julien Olivain
e8394621f7 package/vulkan-headers: needs C++
Since Buildroot commit [1] "package/vulkan-{headers,loader,tools}:
bump to 1.4.317 release", the vulkan-headers package is failing at
configuration time with toolchains without C++ support, with error:

    The C++ compiler
      "/bin/false"
    is not able to compile a simple test program.

This is due to upstream commit [2], which added CXX to the CMake
project file.

This commit fixes the issue by adding the C++ dependency.

Fixes:
https://autobuild.buildroot.org/results/10f63398940d52be9a8ee306daf4203ceca25eb8

[1] 52664093de
[2] 85256c712c

Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 2f6a82b633)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-10-09 08:45:05 +02:00
Waldemar Brodkorb
84f762ef07 package/ruby: update to 3.4.6
See here for changes:
https://github.com/ruby/ruby/releases/tag/v3_4_4
https://github.com/ruby/ruby/releases/tag/v3_4_5
https://github.com/ruby/ruby/releases/tag/v3_4_6

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 38d49568da)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-10-09 08:44:50 +02:00
Peter Korsgaard
10b7de36b2 configs/roseapplepi: remove defconfig, broken
The roseapplepi defconfig fails to build u-boot since the move to GCC 15.x:

https://gitlab.com/buildroot.org/buildroot/-/jobs/11501385206

The issues are mainly related to missing includes, but given that the build
has been broken for a while, there is no mainline u-boot support for the
platform and the minimal kernel support has not seen any updates since it
was added for v5.15, just drop the defconfig.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 56091a5818)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-10-09 08:44:35 +02:00
Dario Binacchi
26c2304ff4 package/fastd: security bump to version 23
This bump includes the security fix for CVE-2025-24356.

Fixes:
https://www.cve.org/CVERecord?id=CVE-2025-24356.

The COPYRIGHT file was renamed to LICENSE [1]. The hash file was updated
because a date was removed [2] and the libmnl version was updated [3].

Release notes:
https://fastd.readthedocs.io/en/stable/releases/v23.html

[1] fa88c739b9
[2] 318c944f40
[3] c08a3d59de
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
[Peter: update FASTD_LICENSE_FILES]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 2b5bcfd626)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-10-09 08:44:18 +02:00
Bernd Kuhls
757d118cda package/gnupg2: bump to version 2.4.8
Release notes:
https://lists.gnupg.org/pipermail/gnupg-announce/2025q3/000496.html

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit d73458b3a5)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-10-09 08:44:00 +02:00
Titouan Christophe
a8624259ac package/python-django: security bump to v5.2.7
For release note, see:
https://docs.djangoproject.com/en/5.2/releases/5.2.7/

This fixes the following vulnerabilities:
- CVE-2025-59681:
    An issue was discovered in Django 4.2 before 4.2.25, 5.1 before
    5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(),
    QuerySet.aggregate(), and QuerySet.extra() are subject to SQL
    injection in column aliases, when using a suitably crafted dictionary,
    with dictionary expansion, as the **kwargs passed to these methods (on
    MySQL and MariaDB).
    https://www.cve.org/CVERecord?id=CVE-2025-59681

- CVE-2025-59682:
    An issue was discovered in Django 4.2 before 4.2.25, 5.1 before
    5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract()
    function, used by the "startapp --template" and "startproject
    --template" commands, allows partial directory traversal via an
    archive with file paths sharing a common prefix with the target
    directory.
    https://www.cve.org/CVERecord?id=CVE-2025-59682

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
[Julien: add link to release note]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 7bbc66a39e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-10-09 08:41:37 +02:00
Bernd Kuhls
7c75c6fb94 package/intel-microcode: security bump version to 20250812
Release notes:
https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20250812

CVE-2025-20109:
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01249.html

CVE-2025-22840:
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01308.html

CVE-2025-22839:
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01310.html

CVE-2025-22889:
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01311.html

CVE-2025-20053:
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01313.html

CVE-2025-26403:
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01367.html

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 0a748cddf6)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-10-09 08:41:16 +02:00
Neal Frager
e4ec6da23e board/versal/post-image: remove unnecessary mkdir
The board/versal/post-image.sh script has an unnecessary mkdir command:
mkdir -p "${BINARIES_DIR}"

This directory is created before calling the post image scripts,
in [1].

Just above the command, the script is making a symlink for the Linux DTB in
the ${BINARIES_DIR}, so if the ${BINARIES_DIR} did not already exist with
images inside, the script would fail regardless of whether this mkdir is
executed or not.

For this reason, remove the mkdir call from the script because it is not
necessary.

[1] https://gitlab.com/buildroot.org/buildroot/-/blob/2025.08/Makefile#L829

Signed-off-by: Neal Frager <neal.frager@amd.com>
[Julien: add a link showing where the directory is created]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 018cf24c80)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-10-09 08:40:46 +02:00
Bernd Kuhls
4a32494015 package/fetchmail: security bump version to 6.5.6
Release notes:
https://sourceforge.net/p/fetchmail/mailman/message/59241831/

CVE pending assignment by MITRE:
https://fetchmail.sourceforge.io/fetchmail-SA-2025-01.txt

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 7cb507b31c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-10-09 08:35:06 +02:00
Bernd Kuhls
20c44f9b22 package/fetchmail: bump version to 6.5.5
Release notes:
https://sourceforge.net/p/fetchmail/mailman/message/59238340/

The COPYING license file was updated in:
e6597cee1e/
a408d51154/
This commit updates its hash accordingly.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: fix COPYING license file hash]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 8082b26a2b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-10-09 08:34:55 +02:00
Titouan Christophe
f43b433360 package/raptor: add patches for CVE-2024-57822, CVE-2024-57823
This fixes the following vulnerabilities:
- CVE-2024-57822:
    In Raptor RDF Syntax Library through 2.0.16, there is a heap-based
    buffer over-read when parsing triples with the nquads parser in
    raptor_ntriples_parse_term_internal().
    https://www.cve.org/CVERecord?id=CVE-2024-57822

- CVE-2024-57823:
    In Raptor RDF Syntax Library through 2.0.16, there is an integer
    underflow when normalizing a URI with the turtle parser in
    raptor_uri_normalize_path().
    https://www.cve.org/CVERecord?id=CVE-2024-57823

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e94cd21e7b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-10-09 08:32:33 +02:00
Titouan Christophe
1e6729bfbc package/ghostscript: security bump to v10.06.0
For release note, see:
https://ghostscript.readthedocs.io/en/gs10.06.0/News.html

This fixes the following vulnerabilities:
- CVE-2025-59798:
    Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow
    in pdf_write_cmap in devices/vector/gdevpdtw.c.
    https://www.cve.org/CVERecord?id=CVE-2025-59798

- CVE-2025-59799:
    Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow
    in pdfmark_coerce_dest in devices/vector/gdevpdfm.c via a large size
    value.
    https://www.cve.org/CVERecord?id=CVE-2025-59799

- CVE-2025-59800:
    In Artifex Ghostscript through 10.05.1, ocr_begin_page in
    devices/gdevpdfocr.c has an integer overflow that leads to a heap-
    based buffer overflow in ocr_line8.
    https://www.cve.org/CVERecord?id=CVE-2025-59800

- CVE-2025-59801:
    In Artifex GhostXPS before 10.06.0, there is a stack-based buffer
    overflow in xps_unpredict_tiff in xpstiff.c because the
    samplesperpixel value is not checked.
    https://www.cve.org/CVERecord?id=CVE-2025-59801

Also remove patch that is now applied upstream, and add new patch from
upstream to fix a compilation issue on 32bits platforms

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
[Julien:
 - add link to release note in commit log
 - fix URL in hash file comment
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 6f984089c0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-10-09 08:32:22 +02:00
Bernd Kuhls
3755e9b680 package/tor: bump version to 0.4.8.18
Release notes:
https://gitlab.torproject.org/tpo/core/tor/-/raw/release-0.4.8/ReleaseNotes
https://forum.torproject.org/t/alpha-and-stable-release-0-4-8-18-and-0-4-9-3-alpha/20578

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 66ef333884)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-10-09 08:32:04 +02:00
Dario Binacchi
25a2040a04 package/expat: security bump to version 2.7.2
This bump includes the security fix for CVE-2025-59375.

Release notes:
https://github.com/libexpat/libexpat/blob/R_2_7_2/expat/Changes

Fixes:
https://www.cve.org/CVERecord?id=CVE-2025-59375

Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 130b35ddcf)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-10-09 08:31:20 +02:00
Francois Perrad
94ac670d5a package/libopenssl: security bump to version 3.5.4
fixes CVE-2025-9230, CVE-2025-9231, CVE-2025-9232
see https://github.com/openssl/openssl/releases/tag/openssl-3.5.4

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit c983f967bd)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-10-09 08:30:31 +02:00
Titouan Christophe
3218502509 package/python-pip: security bump to v25.2
This fixes the following vulnerability:
- CVE-2025-8869:
    When extracting a tar archive pip may not check symbolic links point
    into the extraction directory if the tarfile module doesn't implement
    PEP 706. Note that upgrading pip to a "fixed" version for this
    vulnerability doesn't fix all known vulnerabilities that are
    remediated by using a Python version that implements PEP 706.  Note
    that this is a vulnerability in pip's fallback implementation of tar
    extraction for Python versions that don't implement PEP 706 and
    therefore are not secure to all vulnerabilities in the Python
    'tarfile' module. If you're using a Python version that implements PEP
    706 then pip doesn't use the "vulnerable" fallback code.  Mitigations
    include upgrading to a version of pip that includes the fix, upgrading
    to a Python version that implements PEP 706 (Python >=3.9.17,
    >=3.10.12, >=3.11.4, or >=3.12), applying the linked patch, or
    inspecting source distributions (sdists) before installation as is
    already a best-practice.
    https://www.cve.org/CVERecord?id=CVE-2025-8869

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 78d687d2d2)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-10-09 08:30:22 +02:00
Robert Marko
cf211a0ba1 package/mdio-tools: enable CONFIG_MDIO_BUS
CONFIG_MDIO_BUS was previously a hidden symbol that was selected by
CONFIG_MDIO_DEVICE, however since kernel 6.16 this changed.

CONFIG_MDIO_DEVICE was dropped and now CONFIG_MDIO_BUS is visible and must
be directly selected[1].

So, enable CONFIG_MDIO_BUS directly as otherwise building mdio-tools can
fail with:
ERROR: modpost: "mdio_find_bus" [mdio-netlink.ko] undefined!
ERROR: modpost: "__mdiobus_write" [mdio-netlink.ko] undefined!
ERROR: modpost: "__mdiobus_read" [mdio-netlink.ko] undefined!
ERROR: modpost: "__mdiobus_c45_read" [mdio-netlink.ko] undefined!
ERROR: modpost: "__mdiobus_c45_write" [mdio-netlink.ko] undefined!

[1] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v6.16.9&id=31be641d74267d98317ef5a2b90e6200511cabb3
Fixes: https://autobuild.buildroot.org/results/8595997794a2f603fcef95b559f60f83abfe4d83/

Signed-off-by: Robert Marko <robimarko@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d03d19338b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-10-09 08:29:54 +02:00
Francois Perrad
d519942192 package/luaossl: bump to version 20250929
diff LICENSE:
-    2015-2019  Daurnimator <quae@daurnimator.com>
+    2015-2025  Daurnimator <quae@daurnimator.com>

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit cdb1407c0c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-10-09 08:29:31 +02:00
Nicolas Cavallari
bc6d119ba2 package/linux-firmware: fix license file for ath10k firmware
The WHENCE file [1] indicates ath10k's license file is
LICENSE.QualcommAtheros_ath10k license and not LICENCE.atheros_firmware.

[1] https://gitlab.com/kernel-firmware/linux-firmware/-/blob/20250627/WHENCE#L3700

Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr>
[Julien: add link to WHENCE file]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 752fc349a0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-10-09 08:28:25 +02:00
Alex McLain
2aa666522c package/linux-firmware: add support for Intel 6E Ty architecture
Note:
The first file matching the pattern "iwlwifi-ty-a0-gf-a0*" was
introduced in commit [1], first included in version 20201022.

[1] 4f41e9d643

Signed-off-by: Alex McLain <alex@alexmclain.com>
[Julien: add the note in commit log when the first
  firmware was introduced
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 4a51495d69)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-10-09 08:27:44 +02:00
Dario Binacchi
20b7fe88f7 DEVELOPERS: add Dario Binacchi for empty
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 4997495190)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-10-09 08:27:32 +02:00
Neal Frager
14c0238fac board/zynq: correct zed board links
The web link www.zedboard.org is no longer valid as it routes to a generic
avnet.com boards link. Fix this issue by providing direct links to the Avnet
ZedBoard and Tria MicroZed boards.

Signed-off-by: Neal Frager <neal.frager@amd.com>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 4e7f03314d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-10-09 08:26:56 +02:00
Titouan Christophe
6fa717f7f1 {linux, linux-headers}: bump 6.16.x, 6.12.x, 6.6.x, 6.1.x series
Update the latest kernel releases to:
 - 6.16.8 -> 6.16.9
 - 6.12.48 -> 6.12.49
 - 6.6.107 -> 6.6.108
 - 6.1.153 -> 6.1.154

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-09-30 11:34:02 +02:00
Neal Frager
50e9fd4abf board/xilinx: migrate board web links to amd.com
As the xilinx.com website will soon be going away, migrate all xilinx board
web links from xilinx.com to amd.com.

Signed-off-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 74dcda2544)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-09-30 11:33:43 +02:00
Florian Larysch
132417880e package/linuxptp: update default config
Since upstream commit [1] ("Deprecate the slaveOnly option in favor
of clientOnly."), included in v4.0, ptp4l complains about the
"slaveOnly" option being deprecated on startup.

Update the default config to silence this warning.

[1] fe01cc7c96

Signed-off-by: Florian Larysch <fl@n621.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f70b83914f)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-09-30 11:33:36 +02:00
Thomas Petazzoni
da33bc0e7b configs/atmel_sama5d3xek: remove defconfig, broken
This defconfig no longer builds:

  https://gitlab.com/buildroot.org/buildroot/-/jobs/11161167647

It is still based on the 4.9 kernel, which was LTS but is no longer
maintained.

There is no DEVELOPERS entry attached to this configuration as well,
and this defconfig has been broken for at least 2 months, probably
more (our Gitlab CI history is only kept for ~2 months). So let's drop
it, unles someone volunteers to resurrect it.

Cc: Alexandre Belloni <alexandre.belloni@bootlin.com>
Cc: Ludovic Desroches <ludovic.desroches@microchip.com>
Cc: Nicolas Ferre <nicolas.ferre@microchip.com>
Cc: Patrice Vilchez <Patrice.Vilchez@microchip.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 8e9e4feae1)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-09-30 11:33:22 +02:00
Thomas Petazzoni
0e7927c8fd configs/at91sam9260eknf: remove defconfig, broken
This defconfig no longer builds:

  https://gitlab.com/buildroot.org/buildroot/-/jobs/11161167596

It is still based on the 4.8.6 kernel, which is not even an LTS
kernel, so we cannot easily update to fix the issues which are most
likely due to the newer gcc/binutils versions we're using now.

There is no DEVELOPERS entry attached to this configuration as well,
and this defconfig has been broken for at least 2 months, probably
more (our Gitlab CI history is only kept for ~2 months). So let's drop
it, unles someone volunteers to resurrect it.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 0590ef1a81)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-09-30 11:33:16 +02:00
Raphael Pavlidis
0317555103 package/wlroots: add missing dependency to libgbm
If the render gles2 is enabled then libgbm is required (see [1]).
Therefore, add the dependency to wlroots.

[1]: https://gitlab.freedesktop.org/wlroots/wlroots/-/blob/0.19/render/meson.build?ref_type=heads#L44

Signed-off-by: Raphael Pavlidis <raphael.pavlidis@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 00fb3a57cb)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-09-30 11:32:55 +02:00
Adam Duskett
fde194f179 package/libxkbcommon: bump to version 1.9.2
Changes:
  - No longer hosted at https://xkbcommon.org/download. The website points to
    the github repository. As such, change the URL accordingly.

  - The sha256sum is not provided in the mailing list archive, so the sha256sum
    is locally calculated.

  - The license file was reworded as of commit e120807b:
    """Update license notices to SDPX short identifiers + update LICENSE"""

See release notes, since version 1.7.0:
- 1.8.0: https://lists.freedesktop.org/archives/wayland-devel/2025-February/043969.html
- 1.8.1: https://lists.freedesktop.org/archives/wayland-devel/2025-March/044021.html
- 1.9.0: https://lists.freedesktop.org/archives/wayland-devel/2025-April/044160.html
- 1.9.1: https://lists.freedesktop.org/archives/wayland-devel/2025-May/044209.html
- 1.9.2: https://lists.freedesktop.org/archives/wayland-devel/2025-May/044211.html

Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
[Julien: add links to release notes]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 8abbc307a5)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-09-30 11:32:46 +02:00
Thomas Perale
84c6fa2c69 package/libssh: security bump to v0.11.3
For more details on the version bump, see:
 - https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=301d0e16dfa8a5cac1cff956b6880ca90eb82864

Fixes the following vulnerabilities:

- CVE-2025-8114

    A flaw was found in libssh, a library that implements the SSH
    protocol. When calculating the session ID during the key exchange
    (KEX) process, an allocation failure in cryptographic functions may
    lead to a NULL pointer dereference. This issue can cause the client
    or server to crash.

For more information, see:
 - https://nvd.nist.gov//vuln/detail/CVE-2025-8114
 - https://www.libssh.org/security/advisories/CVE-2025-8114.txt
 - https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=65f363c9e3a22b90af7f74b5c439a133b1047379

- CVE-2025-8277

    A flaw was found in libssh's handling of key exchange (KEX)
    processes when a client repeatedly sends incorrect KEX guesses. The
    library fails to free memory during these rekey operations, which
    can gradually exhaust system memory. This issue can lead to crashes
    on the client side, particularly when using libgcrypt, which impacts
    application stability and availability.

For more infromation, see:
 - https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=87db2659ec608a977a63eea529f17b9168388d73
 - https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=266174a6d36687b65cf90174f06af90b8b27c65f
 - https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=8e4d67aa9eda455bfad9ac610e54b7a548d0aa08
 - https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=1c763e29d138db87665e98983f468d2dd0f286c1

The v0.11.2 already had a fixed for CVE-2025-5318 but the NVD reference
mentionned wrongly the version 0.11.2.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 800dcabe65)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-09-30 11:32:24 +02:00
Thomas Perale
21da53b833 package/tiff: security bump to v4.7.1
For more details on the version bump, see:
  - https://gitlab.com/libtiff/libtiff/-/releases/v4.7.1

This bump includes the security fix for CVE-2025-8176, CVE-2025-8177
that were addressed in commit [1][2].

Also fixes the following vulnerabilities:

- CVE-2024-13978

    A vulnerability was found in LibTIFF up to 4.7.0. It has been
    declared as problematic. Affected by this vulnerability is the
    function t2p_read_tiff_init of the file tools/tiff2pdf.c of the
    component fax2ps. The manipulation leads to null pointer
    dereference. The attack needs to be approached locally. The
    complexity of an attack is rather high. The exploitation appears to
    be difficult. The patch is named
    2ebfffb0e8836bfb1cd7d85c059cd285c59761a4. It is recommended to apply
    a patch to fix this issue.

For more information, see:
  - https://nvd.nist.gov//vuln/detail/CVE-2024-13978
  - 2ebfffb0e8

- CVE-2025-8961

    A weakness has been identified in LibTIFF 4.7.0. This affects the
    function main of the file tiffcrop.c of the component tiffcrop.
    Executing manipulation can lead to memory corruption. The attack can
    only be executed locally. The exploit has been made available to the
    public and could be exploited.

For more information, see:
  - https://nvd.nist.gov//vuln/detail/CVE-2025-8961
  - 0ac97aa7a5

- CVE-2025-9165

    A flaw has been found in LibTIFF 4.7.0. This affects the function
    _TIFFmallocExt/_TIFFCheckRealloc/TIFFHashSetNew/InitCCITTFax3 of the
    file tools/tiffcmp.c of the component tiffcmp. Executing
    manipulation can lead to memory leak. The attack is restricted to
    local execution. The exploit has been published and may be used.
    This patch is called ed141286a37f6e5ddafb5069347ff5d587e7a4e0. It is
    best practice to apply a patch to resolve this issue.

For more information, see:
  - https://nvd.nist.gov//vuln/detail/CVE-2025-9165
  - ed141286a3

This commit also updates the LICENSE.md hash file, which was updated
upstream to include a historical license. See:
a0b623c780

[1] b3974df966 package/tiff: add patches to fix CVE-2025-8176
[2] 3db725d71d package/tiff: add patch to fix CVE-2025-8177

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
[Julien: fix license hash]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 9e67ae519f)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-09-30 11:32:16 +02:00
Thomas Perale
11f0a5f5e2 package/tiff: ignore CVE-2025-8851
The CVE-2025-8851 [1] has been fixed in upstream commit [2] that is part
of the v4.7.0 release.

Because the NVD reference includes the version '<2024-08-11' most of CVE
checker will fail to compare it against 4.7.0 and report it as a
positive.

[1] https://nvd.nist.gov//vuln/detail/CVE-2025-8851
[2] 8a7a48d7a6

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 740412aefc)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-09-30 11:32:08 +02:00
Neal Frager
d747b7aae1 boot/xilinx-prebuilt: add support for plmfw.elf filename
AMD / Xilinx has made the decision to change the name of plm.elf to plmfw.elf
in the prebuilt binaries repo starting with the next update.

This patch updates the xilinx-prebuilt package to support either the old
plm.elf filename or the new plmfw.elf filename.

Signed-off-by: Neal Frager <neal.frager@amd.com>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 6f435187c6)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-09-30 11:31:58 +02:00
Neal Frager
713f7c47f8 boot/uboot: use BR2_TARGET_XILINX_FIRMWARE_ARCH_SUPPORTS
Migrate the BR2_TARGET_UBOOT_ZYNQMP dependency to the new
BR2_TARGET_XILINX_FIRMWARE_ARCH_SUPPORTS symbol. Also, add a cpu dependency
on BR2_cortex_a53 since the zynqmp platform is based on the ARM Cortex-A53
and the BR2_TARGET_UBOOT_ZYNQMP should not be available for other CPUs with
aarch64 architecture.

Signed-off-by: Neal Frager <neal.frager@amd.com>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 5986c51219)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-09-30 11:31:52 +02:00
Neal Frager
4f73d98026 boot/xilinx-prebuilt: only allow binaries for device family
Add an architecture cpu dependency to each family to make sure that users can
only install prebuilt firmware which is applicable to their target device
family.

The versal family is based on BR2_cortex_a72.

The kria and zynqmp families are based on BR2_cortex_a53.

Signed-off-by: Neal Frager <neal.frager@amd.com>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 92f76f6c35)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-09-30 11:31:44 +02:00
Neal Frager
6f5a9d7e36 boot/xilinx-embeddedsw: only allow apps for device family
Add an architecture cpu dependency to each application to make sure that users
can only build applications which are applicable to their target device
family.

The versal_plm and versal_psmfw applications are specific to versal devices
which are based on BR2_cortex_a72.

The zynqmp_pmufw application is specific to zynqmp devices which are based on
BR2_cortex_a53.

Signed-off-by: Neal Frager <neal.frager@amd.com>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 9e25bcfdab)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-09-30 11:31:38 +02:00
Neal Frager
a29eff0860 boot: add BR2_TARGET_XILINX_FIRMWARE_ARCH_SUPPORTS
Currently, the xilinx-embeddedsw and xilinx-prebuilt packages are appearing
for any aarch64 processor. As all Xilinx processors that need these packages
are ARM Cortex-A53 or ARM Cortex-A72, this means that these packages are
often appearing as options for non-Xilinx platforms.

To reduce this occurrence, this patch creates a new symbol
BR2_TARGET_XILINX_FIRMWARE_ARCH_SUPPORTS to limit the appearance of the
xilinx-embeddedsw and xilinx-prebuilt boot packages to only platforms based
on the BR2_cortex_a53 or BR2_cortex_a72 CPU and aarch64 architecture.

Signed-off-by: Neal Frager <neal.frager@amd.com>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 5b1a52aea0)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-09-30 11:31:30 +02:00
Scott Fan
fe6a87cb86 package/libopenssl: bump version to 3.5.3
This release incorporates the following bug fixes and mitigations:
- Added FIPS 140-3 PCT on DH key generation.
- Fixed the synthesised OPENSSL_VERSION_NUMBER.

https://github.com/openssl/openssl/releases/tag/openssl-3.5.3

Signed-off-by: Scott Fan <fancp2007@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 92a6b6c108)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-09-30 11:31:13 +02:00
Titouan Christophe
d2214afdf2 package/cutekeyboard: fix CUTEKEYBOARD_VERSION
Make CUTEKEYBOARD_VERSION compliant with release-monitoring.org

Fixes: b28ec6f431

(alternative to commit 1488546429)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
(cherry picked from commit 6e2b0dd923)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-09-30 11:30:57 +02:00
Adam Duskett
de786cdc70 DEVELOPERS: Remove adam.duskett@amarulasolutions from sway packages
Patches submitted to update these packages have gone ignored for
months without comment, and I no longer wish to recieve daily
emails about them being out of date.

Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 20f99312c9)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-09-30 11:30:42 +02:00
Scott Fan
1316225788 board/qemu/{x86, x86_64}: fix shellcheck warning in post-build.sh
This removes a warning reported by shellcheck: "Double quote to prevent
globbing and word splitting". As a result, the file can be removed from
.checkpackageignore.

Signed-off-by: Scott Fan <fancp2007@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e7937c52b6)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-09-30 11:30:30 +02:00