mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-09 16:01:54 -09:00
Code Issues Packages Projects Releases Wiki Activity
82,119 Commits 6 Branches 483 Tags
d5aef8a047cf83e70868174da22891edd603003b
Commit Graph

82119 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Peter Korsgaard
d5aef8a047 Update for 2026.05-rc3 
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2026.05-rc3 		2026-05-29 00:20:06 +02:00
Peter Korsgaard
f560174011 package/radvd: security bump to version 2.21 
Fixes the following vulnerability:

CVE-2026-48715: Stack Buffer Overflow in radvdump Route Information Option
Parser

https://github.com/radvd-project/radvd/security/advisories/GHSA-52px-gh9p-m379

Release notes:
https://github.com/radvd-project/radvd/releases/tag/v2.21

The release is now done on github, and a .tar.xz version is available so use
that. Notice that we cannot use the github macro.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-05-28 21:42:35 +02:00
Bernd Kuhls
b280053180 package/libde265: security bump version to 1.1.0 
https://github.com/strukturag/libde265/releases/tag/v1.1.0

"Security fixes

- CVE TBD (GHSA-g2rg-wj66-w594) - Out-of-bounds write in
 process_reference_picture_set via predicted short-term RPS
- CVE TBD (GHSA-vv8h-932h-7r86) - Heap buffer overflow in
 de265_image_get_buffer via SPS dimension integer overflow
- CVE TBD (GHSA-g5hj-rf9f-7vxm) - Unbounded memory accumulation via
 orphaned slice headers in read_slice_NAL
- (GHSA-x27c-jp65-g395) - Quadratic CPU consumption in NAL parser
 (remove_stuffing_bytes, resize)

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2026-05-28 00:58:29 +02:00
Bernd Kuhls
f51769b7e9 package/libde265: disable neon support for armv7m 
Buildroot commit d4b8a42fb2 bumped the
package from 1.0.16 to 1.0.18.
Upstream added optional neon support in version 1.0.17:
f22cf00a86

The configure check detects neon support:

-- Performing Test HAVE_NEON
-- Performing Test HAVE_NEON - Success

but causes a build error at linking stage:

[100%] Linking CXX executable dec265
/builds/bkuhls/buildroot/br-test-pkg/bootlin-armv7m-uclibc/host/opt/ext-toolchain/arm-buildroot-uclinux-uclibcgnueabi/bin/ld.real:
 error: ../libde265/libde265.a(hevcdsp_qpel_neon.S.o):
 conflicting architecture profiles A/M

so we add a configure option to disable neon support.

The build error was not yet detected by the autobuilders but can be
reproduced using this defconfig:

BR2_arm=y
BR2_cortex_m4=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_ARMV7M_UCLIBC_STABLE=y
BR2_PACKAGE_LIBDE265=y

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2026-05-28 00:53:24 +02:00
Bernd Kuhls
38358daba9 package/libde265: link with libatomic if needed 
Buildroot commit d4b8a42fb2 bumped the
package to version 1.0.18 which introduced build errors on sparc:

/home/autobuild/autobuild/instance-21/output-1/host/lib/gcc/sparc-buildroot-linux-uclibc/15.2.0/../../../../sparc-buildroot-linux-uclibc/bin/ld:
 ../libde265/libde265.so.0.1.12: undefined reference to
 `__atomic_fetch_add_4'

Fixes:
https://autobuild.buildroot.net/results/605/605dc19e86f113662cc35fe055c64c52698d70b4/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2026-05-28 00:52:13 +02:00
Bernd Kuhls
08f3757b0f package/libheif: security bump version to 1.22.2 
https://github.com/strukturag/libheif/releases/tag/v1.22.2
"Fixes missing heif_image_get_bayer_pattern_size() function."

https://github.com/strukturag/libheif/releases/tag/v1.22.1
"Security
- CVE TBD (GHSA-r7qj-cg5r-r6vf) - Wrapped icef compressed-unit range
 check causes out-of-bounds read in uncompressed HEIF decoder
 - (GHSA-5hqq-636x-r3cr) - Out-of-bounds write in inline mask region API
                           when source mask exceeds declared region"

Removed patch which is included in version 1.22.1.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2026-05-27 08:38:02 +02:00
Bernd Kuhls
46a4dcd0e1 package/samba4: security bump version to 4.24.3 
https://www.samba.org/samba/history/samba-4.24.3.html

Fixes CVE-2026-4408, CVE-2026-4480, CVE-2026-2340, CVE-2026-3012,
CVE-2026-3238 and CVE-2026-1933.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-05-26 19:53:31 +02:00
Peter Korsgaard
8b606d9074 package/python-urllib3: security bump to version 2.7.0 
Fixes the following security issues:

CVE-2026-44431: Sensitive headers forwarded across origins in proxied
low-level redirects

https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc

CVE-2026-44432: Decompression-bomb safeguards bypassed in parts of the
streaming API

https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j

For more details, see the release notes:
https://urllib3.readthedocs.io/en/stable/changelog.html#id1

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-05-26 19:40:36 +02:00
Bernd Kuhls
0455e2571d package/nginx: security bump version to 1.30.2 
https://nginx.org/en/CHANGES-1.30

https://nginx.org/en/security_advisories.html

1.30.2: Fixes CVE-2026-9256
1.30.1: Fixes CVE-2026-42926 (only from 1.29.4), CVE-2026-42945,
CVE-2026-42946, CVE-2026-42934, CVE-2026-40460 & CVE-2026-40701.

Updated license hash due to copyright year bump:
7fa941a55e

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Peter: clarify CVE-2026-42926]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2026-05-26 13:20:13 +02:00
Bernd Kuhls
74aed5e861 package/unbound: security bump version to 1.25.1 
https://nlnetlabs.nl/projects/unbound/download/

Used new signing key to verify the source tarball:
https://nlnetlabs.nl/signing-keys/

Fixes CVE-2026-33278, CVE-2026-42944, CVE-2026-42959, CVE-2026-32792,
CVE-2026-40622, CVE-2026-41292, CVE-2026-42534, CVE-2026-42923,
CVE-2026-42960, CVE-2026-44390 and CVE-2026-44608.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2026-05-26 07:49:38 +02:00
Bernd Kuhls
3ddacc46e4 package/mariadb: security bump version to 10.11.17 
https://mariadb.com/docs/release-notes/community-server/10.11/10.11.17
https://mariadb.com/docs/release-notes/community-server/changelogs/10.11/10.11.17

Fixes CVE-2026-44168, CVE-2026-44169, CVE-2026-44170, CVE-2026-44171,
CVE-2026-44172 & CVE-2026-44173.

https://mariadb.com/docs/release-notes/community-server/10.11/10.11.16
https://mariadb.com/docs/release-notes/community-server/changelogs/10.11/10.11.16

Fixes CVE-2026-3494 & CVE-2026-34303.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-05-25 14:38:20 +02:00
Viacheslav Bocharov
9d4d79f9ae DEVELOPERS: update entry for Viacheslav Bocharov 
- Update email address to v@baodeep.com.
- Take over maintainership of package/amlogic-boot-fip.

Signed-off-by: Viacheslav Bocharov <v@baodeep.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-05-24 21:45:24 +02:00
Bernd Kuhls
8181bc6e06 package/kexec: fix powerpc build 
Added two upstream commits to fix build errors on powerpc.

The build error also occurs with kexec 2.0.30 on the 2025.02.x branch
so a backport to LTS branches should be considered:
https://autobuild.buildroot.net/results/2ec/2ec0d85c658f8264fcc4eef2deb6c67671e3e7ae/

Fixes:
https://autobuild.buildroot.net/results/53b/53bafc454533aeafc21116a99d87391b3049e12a/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-05-24 19:42:11 +02:00
Bernd Kuhls
7418ff1389 package/putty: security bump version to 0.84 
https://lists.tartarus.org/pipermail/putty-announce/2026/000042.html

Updated license hash due to copyright year bump in upstream commit
995b63a82bac4f6985958cb92943e807a9f35736. A link to this commit can not
be provided due to the shutdown of the upstream gitweb interface:
https://git.tartarus.org/?p=simon/putty.git

Switched URLs to https.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-05-24 13:07:51 +02:00
Bernd Kuhls
2888204be6 {linux, linux-headers}: bump 5.{10, 15}.x / 6.{1, 6, 12, 18}.x / 7.0.x series 
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-05-23 21:50:29 +02:00
Bernd Kuhls
852e39ba2c package/{mesa3d, mesa3d-headers}: bump version to 26.1.1 
https://lists.freedesktop.org/archives/mesa-announce/2026-May/000851.html
"The bugfix release 26.1.1 is now available."

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-05-23 11:01:09 +02:00
Bernd Kuhls
f778891f10 package/llvm-project: bump version to 22.1.6 
Release notes of this bugfix release:
https://discourse.llvm.org/t/llvm-22-1-6-released/90838

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-05-23 11:01:02 +02:00
Andreas Ziegler
9d6949b1b1 package/mpd: update version to 0.24.12 
Bug fix of bug fix. Changes from version 0.24.10 -> 0.24.12:

* protocol
  - fix path traversal bug
  - allow empty URI in "lsinfo", "add" etc. (0.24.11 regression)
* playlist: do not allow newlines in song URIs
* input
  - curl: require version 7.85.0
* decoder
  - pcm: fix stack buffer overflow
  - sidplay: fall back to SIDLiteBuilder if ReSIDfpBuilder is unavailable

Signed-off-by: Andreas Ziegler <br025@umbiko.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-05-22 21:50:12 +02:00
Peter Korsgaard
94b0b0c6c1 Update for 2026.05-rc2 
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2026.05-rc2 		2026-05-21 23:20:52 +02:00
Giulio Benetti
2e3db9d233 package/wireshark: bump to v4.4.16 
For more information on the version bump, see:
  - https://www.wireshark.org/docs/relnotes/wireshark-4.4.16.html

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2026-05-21 22:05:50 +02:00
Bernd Kuhls
c9e36ce805 package/haveged: security bump version to 1.9.21 
https://github.com/jirka-h/haveged/blob/v1.9.21/ChangeLog

Fixes CVE-2026-41054: https://seclists.org/oss-sec/2026/q2/575
"The bug was added in 1.9.3."

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2026-05-21 22:00:45 +02:00
Joseph Kogut
a4b761f395 package/wpewebkit: fix stale libepoxy dependency comments 
wpewebkit depends directly on OpenGL ES and EGL support, but those
dependencies are not imposed by libepoxy itself. Update the inline
comments so they describe the actual dependency source before relaxing
libepoxy's package-level EGL/GL dependency.

Signed-off-by: Joseph Kogut <joseph.kogut@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
 2026-05-21 20:48:36 +02:00
Joseph Kogut
701f8bb31c package/weston: add EGL dependency for XWayland 
BR2_PACKAGE_WESTON_XWAYLAND currently depends on BR2_PACKAGE_LIBEPOXY,
which implicitly requires either libGL or libEGL. However, the XWayland
glamor support uses libepoxy with EGL, so express that dependency
directly. With only libGL and no libEGL, it fails to build. E.g.,

BR2_aarch64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_AARCH64_GLIBC_STABLE=y
BR2_PACKAGE_MESA3D=y
BR2_PACKAGE_MESA3D_GALLIUM_DRIVER_ETNAVIV=y
BR2_PACKAGE_MESA3D_OPENGL_GLX=y
BR2_PACKAGE_XORG7=y
BR2_PACKAGE_XWAYLAND=y
BR2_PACKAGE_LIBEPOXY=y

fails with:

In file included from ../glamor/glamor_priv.h:73,
from ../glamor/glamor_composite_glyphs.c:25:
../glamor/glamor_context.h:27:10: fatal error: epoxy/egl.h: No such file or directory
27 | #include <epoxy/egl.h>
   |          ^~~~~~~~~~~~~

Signed-off-by: Joseph Kogut <joseph.kogut@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
 2026-05-21 20:40:28 +02:00
Bernd Kuhls
d08416a5a2 package/memcached: security bump version to 1.6.42 
https://github.com/memcached/memcached/wiki/ReleaseNotes1642

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
 2026-05-20 21:43:06 +02:00
James Hilliard
88a83019df package/cog: fix build with Weston 15 
The current cog release only supports weston protocols up to weston 14

When weston was bumped to version 15 in
2e6b2b82d5 it broke building cog.

Backport a patch adding weston 15 support to cog.

Fixes: No usable weston-protocols dependency found

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
 2026-05-20 21:41:31 +02:00
James Hilliard
8215cb491b package/shadowsocks-libev: fix missing const 
Fixes: https://autobuild.buildroot.org/results/f1a/f1a83cce6216135a96611cc4e4eaa5766ebd730c

output/build/shadowsocks-libev-v3.3.6/src/netutils.c:278:28: error: initialization discards ‘const’ qualifier from pointer target type [-Werror=discarded-qualifiers]
  278 |         char *next_dot   = strchr(label, '.');

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
 2026-05-20 21:40:00 +02:00
Giulio Benetti
5528e00b10 package/bind: security bump to version 9.18.49 
Release notes:
https://ftp.isc.org/isc/bind9/9.18.49/doc/arm/html/notes.html

Changelog:
https://ftp.isc.org/isc/bind9/9.18.49/doc/arm/html/changelog.html

Fixes CVE-2026-3592, CVE-2026-3039, CVE-2026-5946, CVE-2026-5950.

Fixes bugs:
GL #5804
https://gitlab.isc.org/isc-projects/bind9/-/issues/5804
GL #3589
https://gitlab.isc.org/isc-projects/bind9/-/issues/3589

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
 2026-05-20 21:36:41 +02:00
Bernd Kuhls
47b5cbb1ca package/rsync: security bump version to 3.4.3 
https://download.samba.org/pub/rsync/NEWS#3.4.3

Fixes CVE-2026-29518, CVE-2026-43617, CVE-2026-43618, CVE-2026-43619,
CVE-2026-43620 & CVE-2026-45232.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
 2026-05-20 21:36:20 +02:00
Bernd Kuhls
4e14863c94 package/imagemagick: security bump version to 7.1.2-23 
https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#712-23---2026-05-17

Fixes the following CVEs:
CVE-2026-42326, CVE-2026-45031, CVE-2026-45358, CVE-2026-45359,
CVE-2026-45624, CVE-2026-45664, CVE-2026-46520, CVE-2026-46521,
CVE-2026-46522, CVE-2026-46523, CVE-2026-46557 & CVE-2026-46559.
[copied list of CVEs from
 https://www.news.de/technik/859626214/imagemagick-gefaehrdet-it-sicherheitshinweis-vom-bsi-und-bug-report-bekannte-schwachstellen-und-sicherheitsluecken/1/]

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
 2026-05-20 21:32:19 +02:00
Bernd Kuhls
0d3d25bcc9 package/libde265: security bump version to 1.0.19 
https://github.com/strukturag/libde265/releases/tag/v1.0.19

Fixes CVE-2026-45382 & CVE-2026-45383.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
 2026-05-20 21:31:52 +02:00
Bernd Kuhls
944f41e9e2 package/libheif: security bump version to 1.22.0 
https://github.com/strukturag/libheif/releases/tag/v1.22.0

Fixes the following CVEs/advisories:

CVE-2026-32738 (GHSA-7f2h-cmpf-v9ww) : Heap OOB Read / SEGV Crash via Zero samples_per_chunk in stsc
CVE-2026-32739 (GHSA-j9g7-q9hv-gq8c) : Infinite Loop DoS in stts Sample Duration Lookup
CVE-2026-32740 (GHSA-frfr-f3vg-2g6j) : Heap-Buffer-Overflow Write in Grid Tile Chroma Compositing
CVE-2026-32741 (GHSA-j3w5-7whq-p37q) : heap buffer overflow in decode_mask_image()
CVE-2026-32814 (GHSA-4m8r-34pg-rvwc) : Uninitialized Heap Memory Information Leak via Failed Grid Tiles
CVE-2026-32882 (GHSA-hg7q-rjr2-8x46) : Heap Buffer OOB Read in overlay compositing due to wrong alpha stride
CVE-2026-41069 (GHSA-p82x-fpmv-576r) : Out-of-bounds vector access leading to invalid dereference
CVE-2026-41071 (GHSA-xj92-xjff-h8w3) : Heap buffer over-read in SampleAuxInfoReader via crafted HEIF sequence file with mismatched saiz sample count
CVE-2026-47178 (GHSA-5x55-x5pf-9c6g) : Heap Out Of Bounds Write in unci subsystem
CVE-2026-47247 (GHSA-2vh6-whr3-cmq3) : Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane Allocation
CVE-2026-47251 (GHSA-p6q9-fhf2-vj9v) : Incomplete fix for CVE-2026-3949: integer overflow bypass in vvdec_push_data2
CVE-2026-47254 (GHSA-wqjg-4x9g-6cvg) : Heap Buffer Overflow in Track::get_next_sample_raw_data() -- OOB Chunk Vector Access
CVE-2026-47709 (GHSA-4h72-vqgp-9376) : NULL pointer dereference in heif_image_handle_get_image_tiling for malformed unci image missing ispe
CVE-2026-47714 (GHSA-h4wm-6wwf-qvhx) : Integer overflow in inline mask size calculation causes undersized buffer allocation
CVE TBD (GHSA-6x5f-qchq-cxqv) : heap OOB read in ImageItem_Grid::decode_grid_tile via irot-induced tile-coordinate underflow
(GHSA-95jx-g5vf-cpp8) : Integer Overflow in SampleAuxInfoReader Offset Calculation
(GHSA-p4r6-6972-g26m) : Incorrect byte-count initialization in BitstreamRange constructor allows container-boundary check bypass
(GHSA-jh2w-m72q-q595) : Out-of-bounds read and assertion-based DoS in EXIF parsing (find_exif_tag / read32) with short EXIF TIFF payload
(GHSA-9h96-c44j-jpq9) : Heap buffer overflow via uint32_t stride overflow in image plane allocation

Added upstream commit to fix build error with imagemagick which would
be introduced by this bump.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
 2026-05-20 21:31:11 +02:00
Andreas Mohr
1ef471a61d package/libargon2: fix pkgconfig version string 
Current build generated pkgconfig/libargon2.pc has wrong version string.
    Version: ZERO

Signed-off-by: Andreas Mohr <and@gmx.li>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
 2026-05-20 21:25:57 +02:00
Arnout Vandecappelle
8f7ae01409 CHANGES: Update for 2026.02.2 
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>

(cherry picked from commit 9bf4d998d8)
 2026-05-20 14:04:33 +02:00
Arnout Vandecappelle
fe893189c8 Update news.html and download.html for 2026.02.2 
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
 2026-05-20 14:04:33 +02:00
Arnout Vandecappelle
91d019e5e2 CHANGES: Update for 2025.02.14 
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>

(cherry picked from commit 92f9688952)
 2026-05-20 14:02:20 +02:00
Arnout Vandecappelle
01f9b3d7f2 Update news.html and download.html for 2025.02.14 
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
 2026-05-20 14:02:18 +02:00
Shubham Chakraborty
c17d110b10 DEVELOPERS: added Shubham Chakraborty for htop 
Signed-off-by: Shubham Chakraborty <chakrabortyshubham66@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
 2026-05-18 22:21:12 +02:00
Shubham Chakraborty
009b044a44 package/htop: bump to version 3.5.1 
This patch updates htop from version 3.5.0 to 3.5.1, a minor bugfix
release.

Changelog:
- https://github.com/htop-dev/htop/blob/main/ChangeLog

Builds Tested Using:
- utils/test-pkg -a -p htop

Signed-off-by: Shubham Chakraborty <chakrabortyshubham66@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
 2026-05-18 22:18:14 +02:00
John Ernberg
12a6a7d1c6 package/openvmtools: Add patch to fix build failure with newer glib versions 
Later versions of glib defines g_free as a macro, causing build
failures. Add patch from upstream pull request to fix the issue.

Fixes: https://autobuild.buildroot.org/results/5c6/5c6407b9f8ac1959717e18d81d629b4a4455b06d
Cc: Karoly Kasza <kaszak@gmail.com>
Signed-off-by: John Ernberg <j@j-ernberg.se>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
 2026-05-18 21:31:50 +02:00
Bernd Kuhls
b28aeeab1f package/gnupg2: security bump version to 2.5.20 
https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000505.html
"This release adds two features to gpgsm and fixes a some minor security
 bugs."

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-05-18 20:57:43 +02:00
Julien Olivain
b2e3521685 package/tzdata: bump to 2026b 
For release notes, see:
https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/VX2Z3CBO6KHTYZNBBKFFWM7ZCI6TVCXP/

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
 2026-05-18 20:18:14 +02:00
Julien Olivain
721a44f935 package/zic: bump to 2026b 
For release notes, see:
https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/VX2Z3CBO6KHTYZNBBKFFWM7ZCI6TVCXP/

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
 2026-05-18 20:17:43 +02:00
Julien Olivain
fa7583c86b package/python-google-api-core: propagate python-google-auth dependencies 
Fixes:

WARNING: unmet direct dependencies detected for BR2_PACKAGE_PYTHON_GOOGLE_AUTH
  Depends on [n]: BR2_PACKAGE_PYTHON3 [=y] && BR2_PACKAGE_HOST_RUSTC_TARGET_ARCH_SUPPORTS [=n]
  Selected by [y]:
  - BR2_PACKAGE_PYTHON_GOOGLE_API_CORE [=y] && BR2_PACKAGE_PYTHON3 [=y] && BR2_PACKAGE_HOST_PROTOBUF_ARCH_SUPPORTS [=y]

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
 2026-05-18 20:12:00 +02:00
Giulio Benetti
668b47bdab package/zlib-ng: fix build failure for PowerPC soft-float 
As suggested in this review[1], when building for PowerPC with soft-float
enabled, let's also disable both WITH_POWER8/9 that in order disables
all the possible PowerPC acceleration instructions.

Fixes:
https://autobuild.buildroot.org/results/a0fa5a175c546993d818371a0de93b2e9845a183/

[1]: https://github.com/zlib-ng/zlib-ng/pull/2151/changes#r2803264882

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
 2026-05-17 23:59:43 +02:00
Giulio Benetti
d0f43c052c package/libnss: fix build failure on big endian architectures 
Add local patch pending upstream to fix build failure due to missing gcm
stubs.

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
 2026-05-17 23:53:00 +02:00
Julien Olivain
ec694f8f6d package/fwts: bump to version 26.03.00 
See release announces:
26.01.00: https://lists.ubuntu.com/archives/fwts-devel/2026-January/014129.html
26.03.00: https://lists.ubuntu.com/archives/fwts-devel/2026-March/014171.html

The website [1] is no longer working. This commit updates FWTS_SITE
to use Github [2], which is now the primary download site in the
release announce.

This commit also rewrote the package patch (to add a new
--disable-werror configure option), which was proposed upstream.
This new option is added in FWTS_CONF_OPTS. With this patch now
proposed upstream, the corresponding .checkpackageignore entry
is also removed.

The license hash is also updated, after a year update in [3].

The fwts efi_runtime kernel module has been removed upstream,
in commit [4]. It is replaced by the Kernel driver efi_test, present
since Kernel v4.9, introduced in commit [5]. This commit removes the
option and updates the runtime test accordingly. A note is added in the
Config.in package help.

Fixes:
https://autobuild.buildroot.org/results/859390dbd2a1d7b3bf43588a461a2ff7dc66f92b/

[1] https://fwts.ubuntu.com/
[2] https://github.com/fwts/fwts
[3] b3cd64e61d
[4] 6d52a62169
[5] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=ff6301dabc3ca20ab8f50f8d0252ac05da610d89

Signed-off-by: Julien Olivain <ju.o@free.fr>
[Romain: add a comment for FWTS_AUTORECONF = YES]
Signed-off-by: Romain Naour <romain.naour@smile.fr>
 2026-05-17 23:47:48 +02:00
Michael Nosthoff
56ff67b50b package/supertux: fix build with gcc > 11 
Fixes:
 "missing #include <memory>" when building with GCC > 11.

Signed-off-by: Michael Nosthoff <buildroot@heine.tech>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
 2026-05-17 23:38:52 +02:00
Bernd Kuhls
9fb64dfc24 package/postgresql: security bump version to 18.4 
https://www.postgresql.org/about/news/postgresql-184-1710-1614-1518-and-1423-released-3297/

Fixes CVE-2026-6472, CVE-2026-6473, CVE-2026-6474, CVE-2026-6475,
CVE-2026-6476, CVE-2026-6477, CVE-2026-6478, CVE-2026-6479,
CVE-2026-6575, CVE-2026-6637, CVE-2026-6638.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-05-17 22:13:43 +02:00
Bernd Kuhls
f049a07fb0 {linux, linux-headers}: bump 5.{10, 15}.x / 6.{1, 6, 12, 18}.x / 7.0.x series 
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2026-05-17 18:55:38 +02:00
Florian Larysch
6b1b1d6380 package/libnfs: fix build on strict alignment archs 
Building libnfs fails on targets that have alignment requirements via
-Wcast-align even though the underlying buffers are sufficiently
aligned. Import the upstream fix that silences those warnings.

Fixes: https://autobuild.buildroot.org/results/d7c/d7c0bc5861afdf9bc26906e9abd217bef898fc48

Signed-off-by: Florian Larysch <fl@n621.de>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
 2026-05-15 19:14:16 +02:00