Commit Graph

79511 Commits

Author SHA1 Message Date
Pierre-Yves Kerbrat
e2f67d3f17 package/rdma-core: bump to version v60.0
For change log since v58.0, see:
https://github.com/linux-rdma/rdma-core/releases/tag/v59.0
https://github.com/linux-rdma/rdma-core/releases/tag/v60.0

Signed-off-by: Pierre-Yves Kerbrat <pkerbrat@free.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-11-20 19:18:59 +01:00
Bernd Kuhls
1023741fb1 package/pcre2: bump version to 10.47
Release notes:
https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.47

Updated license hash due to upstream commits:
4f5a2ada2e
1fffb0d44e
d8a9f2fe55

Added license file for sljit:
d8a9f2fe55

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-11-20 19:01:56 +01:00
Thomas Perale
51558fa3ea DEVELOPERS: add Thomas Perale to cve-check & cve.py
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-11-20 17:43:06 +01:00
Thomas Perale
6762c42e74 support/scripts/cve-check: add cve-check script
Enriches the input CycloneDX SBOM with vulnerability information and
analysis from the NVD database.

The NVD database is cloned using a mirror of it and the content is compared
locally. By default the path 'dl/buildroot-nvd' is used.

Example usage to analyse vulnerabilities of an input CycloneDX SBOM:

$ make show-info | utils/generate-cyclonedx | support/script/cve-check

The 'cve-check' can also be used to only enrich the vulnerabilities
present on the input SBOM with a set metadata (description, cvss,
references, ...) without applying an analysis.

With the following command the vulnerabilities ignored by Buildroot
present in the CycloneDX SBOM are enriched with description, cvss, etc
...

$ make show-info | utils/generate-cyclonedx | support/script/cve-check --enrich-only

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
[Peter: fix minor flake8 issues]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-11-20 17:13:40 +01:00
Thomas Perale
867017e736 support/scripts/cve.py: don't call download_nvd
This patch move the 'download_nvd' call to the 'pkg-stats' script
instead of automatically calling 'read_nvd_dir'.

Since the cve.py file can be used as a library it's up to the caller to
decide whether or not to update the NVD database.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-11-20 17:03:39 +01:00
Bernd Kuhls
903c0db86e package/python-scp: fix dependency
Buildroot commit 3963c3c06e added this
package which selects python-paramiko but forgot to add its dependency.

Fixes warning:

WARNING: unmet direct dependencies detected for BR2_PACKAGE_PYTHON_PARAMIKO
  Depends on [n]: BR2_PACKAGE_PYTHON3 [=y] && BR2_PACKAGE_HOST_RUSTC_TARGET_ARCH_SUPPORTS [=n]
  Selected by [y]:
  - BR2_PACKAGE_PYTHON_SCP [=y] && BR2_PACKAGE_PYTHON3 [=y]

seen with https://autobuild.buildroot.net/results/423/4235283218bc49f53bf7cafd4a67f380dba659c0/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-11-20 17:01:03 +01:00
Bernd Kuhls
bb004ddba2 package/e2fsprogs: bump version to 1.47.3
Release notes:
https://git.kernel.org/pub/scm/fs/ext2/e2fsprogs.git/tree/doc/RelNotes/v1.47.3.txt

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-11-20 17:00:05 +01:00
Bernd Kuhls
56a1c162c5 package/llvm-project: bump to version 21.1.6
Release notes:
https://discourse.llvm.org/t/llvm-21-1-6-released/88895

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-11-19 21:43:02 +01:00
Bernd Kuhls
658e2287bf package/spirv-llvm-translator: bump version to 21.1.2
Release notes:
https://github.com/KhronosGroup/SPIRV-LLVM-Translator/releases/tag/v21.1.2

Changelog:
https://github.com/KhronosGroup/SPIRV-LLVM-Translator/compare/v21.1.1...v21.1.2

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-11-19 21:42:05 +01:00
Zoltan Gyarmati
cc5a1d3daa package/shapelib: bump to 1.6.2
For release notes, see:
http://shapelib.maptools.org/release.html

Signed-off-by: Zoltan Gyarmati <mr.zoltan.gyarmati@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-11-19 21:37:24 +01:00
Bernd Kuhls
55d1f2825b package/openvpn: security bump version to 2.6.16
Fixes CVE-2025-13086.

Release notes:
https://sourceforge.net/p/openvpn/mailman/message/59261309/

Changelog:
https://github.com/OpenVPN/openvpn/blob/release/2.6/ChangeLog
https://github.com/OpenVPN/openvpn/blob/release/2.6/Changes.rst

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-11-19 21:30:41 +01:00
Peter Korsgaard
779827f765 package/python-django: security bump to version 5.2.8
Fixed the following security issues:

CVE-2025-64458: Potential denial-of-service vulnerability in
HttpResponseRedirect and HttpResponsePermanentRedirect on Windows

CVE-2025-64459: Potential SQL injection via _connector keyword argument

https://docs.djangoproject.com/en/5.2/releases/5.2.8/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-11-19 21:13:59 +01:00
Bernd Kuhls
45a9ca057f package/llvm-project: bump to version 21.1.5
Release notes: https://discourse.llvm.org/t/llvm-21-1-5-released/88776

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-11-19 21:08:03 +01:00
Bernd Kuhls
4298e21e0a package/openocd: fix build with jimtcl 0.83
Buildroot commit 283821fc31 bumped jimtcl
to version 0.83 causing build errors with openocd.

Add two upstream commits to fix the problem.

Fixes:
https://autobuild.buildroot.net/results/f20/f20667f8fe159de6601a81a827f26d4f0382d673/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-11-19 20:35:11 +01:00
Pierre-Yves Kerbrat
8e5e8ea2cf package/rauc: bump to 1.15
Changelog: https://github.com/rauc/rauc/releases/tag/v1.15

The COPYING license hash file is updated, due to upstream update:
fe86f27725

Signed-off-by: Pierre-Yves Kerbrat <pkerbrat@free.fr>
Reviewed-by: Marcus Hoffmann <buildroot@bubu1.eu>
Tested-by: Marcus Hoffmann <buildroot@bubu1.eu>
[Julien: add link to upstream commit updating the license]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-11-19 19:16:49 +01:00
José Luis Salvador Rufo
6ff1bd328a package/zfs: bump version to 2.3.5
For release note, see:
https://github.com/openzfs/zfs/releases/tag/zfs-2.3.5

Signed-off-by: José Luis Salvador Rufo <salvador.joseluis@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-11-18 22:13:14 +01:00
Zoltan Gyarmati
2549e2b4fe package/quazip: bump version to 1.5
For release notes, see:
https://github.com/stachenov/quazip/releases/tag/v1.5

Signed-off-by: Zoltan Gyarmati <mr.zoltan.gyarmati@gmail.com>
[Julien: add link to release notes]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-11-18 22:03:58 +01:00
Pierre-Yves Kerbrat
2ce329692a package/stress-ng: bump to 0.19.06
Changelog:
https://github.com/ColinIanKing/stress-ng/blob/V0.19.06/debian/changelog

Signed-off-by: Pierre-Yves Kerbrat <pkerbrat@free.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-11-18 18:06:28 +01:00
Bernd Kuhls
88c26c4814 DEVELOPERS: remove Julien Corjon, e-mail bounces
<corjon.j@ecagroup.com>: host ecagroup-com.mail.protection.outlook.com[52.101.166.0]
 said: 550 5.4.1 Recipient address rejected: Access denied.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-11-18 08:05:02 +01:00
Yi Zheng
d6d8b5823a fs/squashfs: correct aarch64 conditional
BR_aarch64 is not defined. it seems should be BR2_aarch64

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-11-18 08:02:01 +01:00
Bernd Kuhls
5db55534af DEVELOPERS: remove Bernd Kuhls from libdecor & libfreeglut
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-11-17 23:18:15 +01:00
Bernd Kuhls
a1f5023bd9 package/libdecor: bump version to 0.2.4
Commit log:
https://gitlab.freedesktop.org/libdecor/libdecor/-/commits/0.2.4

Switched to xz tarball and hash provided by upstream.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-11-17 23:18:15 +01:00
Bernd Kuhls
75a566edb4 package/libfreeglut: bump version to 3.8.0
Changelog: https://github.com/freeglut/freeglut/blob/v3.8.0/ChangeLog

Removed all patches, they are included in this release.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-11-17 23:18:15 +01:00
Yann E. MORIN
855cd60573 package/distribution-registry: fix build on i386
The S3 storage drivers defines the maximum size of a chunk to a value
thqt does not fit in the native integer on 32-bit architectures. This
causes build failures:

    registry/storage/driver/s3-aws/s3.go:312:99: cannot use maxChunkSize
    (untyped int constant 5368709120) as int value in argument to
    getParameterAsInteger (overflows)

Ideally, we'd like to use a build tag that refers to whether the
architecture is 32- or 64-bit, but there is no such flag. Sigh...

Instead, backport a patch from upstream that papers over the issue, by
using the i386 build tag (of course, that still misses other 32-bit
archs, but are they really relevant in this case?).

Fixes:
https://autobuild.buildroot.org/results/8fa9c5f63f690b27336051be5178f0516e0c54d4/

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
[Julien: add "Fixes:" link]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-11-17 22:28:52 +01:00
Dario Binacchi
ea9d7398ca package/pocketpy: bump to version 2.1.4
Release notes:
https://github.com/pocketpy/pocketpy/releases/tag/v2.1.4

Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-11-17 22:17:39 +01:00
Dario Binacchi
6a45133a5f package/uuu: bump to version 1.5.239
Release notes:
https://github.com/nxp-imx/mfgtools/releases/tag/uuu_1.5.239

Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-11-17 22:10:03 +01:00
Bernd Kuhls
0bf0d30591 package/libdrm: bump version to 2.4.129
Release notes:
https://lists.x.org/archives/xorg-announce/2025-November/003642.html

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-11-17 22:03:34 +01:00
Peter Korsgaard
80764d7208 package/luksmeta: security bump to version 10
Fixes the following security issue:

CVE-2025-11568: A  data corruption vulnerability has been identified in the
luksmeta utility when used with the LUKS1 disk encryption format.

https://github.com/advisories/GHSA-pvmm-7c2r-wmp4
https://github.com/latchset/luksmeta/releases/tag/v10

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-11-17 21:50:34 +01:00
Alexander Shirokov
6fb10dcf21 package/broot: bump version to 1.53.0
Changelog:
https://github.com/Canop/broot/blob/v1.53.0/CHANGELOG.md

Signed-off-by: Alexander Shirokov <shirokovalexs@gmail.com>
[Julien: update changelog URL to use tag]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-11-17 21:34:16 +01:00
Titouan Christophe
896e19a5c6 package/redis: security bump to v8.2.3
See the release notes: https://github.com/redis/redis/releases/tag/8.2.3

This fixes the following vulnerability:
- CVE-2025-62507:
    Redis is an open source, in-memory database that persists on disk. In
    versions 8.2.0 and above, a user can run the XACKDEL command with
    multiple ID's and trigger a stack buffer overflow, which may
    potentially lead to remote code execution. This issue is fixed in
    version 8.2.3. To workaround this issue without patching the redis-
    server executable is to prevent users from executing XACKDEL
    operation. This can be done using ACL to restrict XACKDEL command.
    https://www.cve.org/CVERecord?id=CVE-2025-62507

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-11-17 21:09:58 +01:00
Giulio Benetti
699614e7fd package/libtraceevent: bump to version 1.8.6
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-11-17 21:01:38 +01:00
Pierre-Yves Kerbrat
cf807faf2f package/whois: bump to version 5.6.5
Changelog:
https://github.com/rfc1036/whois/blob/v5.6.5/debian/changelog

Signed-off-by: Pierre-Yves Kerbrat <pkerbrat@free.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-11-17 20:39:47 +01:00
Thomas Devoogdt
8ccee2be22 package/openjdk{, -bin}: fix wrong version reporting
Before:

$ java --version
openjdk 17 2024-07-16
OpenJDK Runtime Environment (build 17+17)
OpenJDK 64-Bit Server VM (build 17+17, mixed mode)

After:

$ java --version
openjdk 17.0.12 2024-07-16
OpenJDK Runtime Environment (build 17.0.12+7)
OpenJDK 64-Bit Server VM (build 17.0.12+7, mixed mode)

Signed-off-by: Thomas Devoogdt <thomas.devoogdt@barco.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-11-16 23:07:13 +01:00
Bernd Kuhls
7727f96648 package/ola: remove package
The package is incompatible with newer versions of protobuf:
https://github.com/OpenLightingProject/ola/issues/1879#issuecomment-2567133849
https://github.com/OpenLightingProject/ola/pull/1975#issuecomment-2346854820

with no upstream fixes in sight and fails to build with protobuf 29.3
currently used by buildroot:
https://lists.buildroot.org/pipermail/buildroot/2025-February/772533.html

Fixes:
https://autobuild.buildroot.net/results/fbb/fbbfef6e3715c0ac195537ab88ebb2e0e6c90c2f/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Acked-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-11-16 22:49:30 +01:00
Bernd Kuhls
1f973844d1 package/libroxml: fix musl build errors
Fixes:
https://autobuild.buildroot.net/results/0ff/0ff4394319d2014884328c347ef495da327a562e/

Added Upstream tag to patch 0001.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-11-16 22:26:37 +01:00
Bernd Kuhls
2193b55bac package/iputils: fix merged-bin
mv: '/home/autobuild/autobuild/instance-2/output-1/per-package/iputils/target/usr/bin/arping'
 and '/home/autobuild/autobuild/instance-2/output-1/per-package/iputils/target/usr/sbin/arping'
 are the same file

Fixes:
https://autobuild.buildroot.net/results/dae/daeebb090f6d11d77840dd61add9bc422c6bc2fa/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-11-16 21:58:57 +01:00
Bernd Kuhls
2479f5ba1e package/perl-net-ssleay: requires DES support in openssl
Fixes:
https://autobuild.buildroot.net/results/953/953210ed672559e63a96da729182af00ca02c011/

The build error occurred already in 2024:
https://autobuild.buildroot.net/results/f93/f930c7b3219a57421c1b0a0ef3a4445c19b43e97/
so backporting this fix seems needed.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-11-16 21:53:51 +01:00
Bernd Kuhls
f8c7a40015 package/batman-adv: bump version to 2025.4
Changelog:
https://git.open-mesh.org/batman-adv.git/tree/CHANGELOG.rst?h=v2025.4

Removed patch which is included in this release.

Upstream removed network coding support:
https://git.open-mesh.org/batman-adv.git/commit/?id=2cefbadba8b2c547058b7d2e5da96692ef3580d7
Add legacy support for the corresponding Config.in option.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-11-16 19:53:23 +01:00
Bernd Kuhls
a7a56546e2 package/libdvdnav: bump version to 7.0.0
Changelog:
https://code.videolan.org/videolan/libdvdnav/-/blob/7.0.0/ChangeLog

Updated _SITE, switched tarball to xz and build system to meson.
Removed unneeded _CONF_ENV.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: fix check-package error in hash file]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-11-16 19:17:40 +01:00
Bernd Kuhls
2496f5fde2 package/libdvdread: bump version to 7.0.1
Release notes:
https://code.videolan.org/videolan/libdvdread/blob/7.0.1/NEWS

Updated _SITE, switched tarball to xz and build system to meson.
Removed unneeded _CONF_ENV.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-11-16 19:17:29 +01:00
Bernd Kuhls
cd3a2f0ff3 package/libdvdcss: bump version to 1.5.0
Release notes:
https://code.videolan.org/videolan/libdvdcss/-/blob/1.5.0/NEWS

Added patch to fix build errors.

Updated _SITE, switched tarball to xz and build system to meson.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: fix check-package error in hash file]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-11-16 19:17:29 +01:00
Zoltan Gyarmati
75dc8e1842 DEVELOPERS: update Zoltan Gyarmati e-mail address
Signed-off-by: Zoltan Gyarmati <mr.zoltan.gyarmati@gmail.com>
[Julien: reword commit log title]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-11-16 18:53:08 +01:00
Bernd Kuhls
06016a5750 package/tvheadend: bump version
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-11-16 17:51:55 +01:00
Dario Binacchi
0289d61dfa package/netopeer2: bump to version 2.4.5
This release depends on libyang (v3.13.6), libnetconf2 (v3.7.10) and
sysrepo (v3.7.11).

See https://github.com/CESNET/netopeer2/releases/tag/v2.4.5
for the changes.

Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
[Julien: change release notes link to point on exact release]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-11-16 11:41:30 +01:00
Dario Binacchi
621da9d961 package/sysrepo: bump version to 3.7.11
For release notes, see:
https://github.com/sysrepo/sysrepo/releases/tag/v3.7.11

Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
[Julien: add link to release notes]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-11-16 11:39:53 +01:00
Dario Binacchi
c49e140bfb package/libyang: bump to version 3.13.6
For release notes, see:
https://github.com/CESNET/libyang/releases/tag/v3.13.6

License file changed due to copyright year change:

-Copyright (c) 2015-2024, CESNET
-Copyright (c) 2015 - 2025, CESNET

Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
[Julien: add link to release notes]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-11-16 11:38:56 +01:00
Dario Binacchi
6d6662e5fd package/libnetconf2: bump to version to 3.7.10
For release notes, see:
https://github.com/CESNET/libnetconf2/releases/tag/v3.7.10

Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
[Julien: add link to release notes]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-11-16 11:37:43 +01:00
Dario Binacchi
9e790ad1a1 package/netcat-openbsd: bump to version 1.234
The hash file for license (netcat.c) has changed due to copyright year
updates and changes not related to the license topic.

Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
[Julien: fix license hash]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-11-15 22:07:55 +01:00
Peter Korsgaard
279cbbdb64 utils/check-package: add a check for 'default n' in Config.in files
Boolean Config.in symbols default to 'n', so we typically do not add such
redundant lines.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-11-15 21:56:10 +01:00
Peter Korsgaard
74f5650396 package/pppd: drop 'default n' for cbcp option
Commit 53a302c6ed ("package/pppd: Add an option to enable/disable CBCP
support.") added a 'default n' line to Config.in, but booleans default to
'n', so we typically do not add such redundant lines.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-11-15 21:56:10 +01:00