Commit Graph

81189 Commits

Author SHA1 Message Date
Thomas Richard
e5f300a871 board/stmicroelectronics/stm32mp135f-dk: fix silent crash in U-Boot
Backport upstream patches to fix a silent crash in U-Boot on
STM32MP135F-DK.

Fixes:

  799d184e89

Signed-off-by: Thomas Richard <thomas.richard@bootlin.com>
[Romain: add Fixes link]
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit 5af624386e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:56:20 +01:00
Yann E. MORIN
667111a94d docs/manual: use space-separated list for BR2_EXTERNAL
Specifying a list of br2-external trees is poorly documented, and the
only example uses a colon to separate the br2-external paths.

Adding the support for colon-separated list is the biggest mistake that
was made when introducing support for multiple br2-external [0]. Indeed,
both space and colon can be used to separate entries in the list, and it
is also possible to mix the two. However, internally, the list is stored
as a space-separated list, and all the code will split on spaces.

Besides, all other lists in Buildroot are a space-separated:
    BR2_ROOTFS_DEVICE_TABLE
    BR2_ROOTFS_STATIC_DEVICE_TABLE
    BR2_TARGET_TZ_ZONELIST
    BR2_ROOTFS_USERS_TABLES
    BR2_ROOTFS_OVERLAY
    BR2_ROOTFS_PRE_BUILD_SCRIPT
    BR2_ROOTFS_POST_BUILD_SCRIPT
    BR2_ROOTFS_POST_FAKEROOT_SCRIPT
    BR2_ROOTFS_POST_IMAGE_SCRIPT
    ...

So, using colons is odd.

The fact that BR2_EXTERNAL is passed on the command line rather than
being a Kconfig item is not a reason enough to justify that it be
colon-separated.

Change the documentation to only mention using a space-separated list.

Of course, for backward compatibility, we keep the code as-is to accept
a colon-separated list, but we just do not advertise it.

Note that keeping the split on colons means that colons are not accepted
in pathnames of br2-external trees; in practice, this is not a new
restriction, or one that could lift as usign colons in Makefiles are
problematic anyway.

[0] in 20cd497387 core: add support for multiple br2-external trees

Reported-by: Fiona Klute (WIWA) <fiona.klute@gmx.de>
Reported-by: Brandon Maier <Brandon.Maier@collins.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit f9cdca48a5)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:56:18 +01:00
Yann E. MORIN
b7aa889e19 support/br2-external: fix remaining shellcheck errors
Boring changes: either do what shellcheck suggested, or comment why we
don't want to fix the code.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit 72e068001b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:56:15 +01:00
Yann E. MORIN
846bd9b002 support/br2-external: remove leftover trap
The trap was initially introduced in c5fa9308ea (core/br2-external:
properly report unexpected errors), in 2017, to catch all unexpected
errors, back when a single file was generated, and errors emitted to
stderr.

Since commit d027cd75d0 (core: generate all br2-external files in
one go), in 2019 the single output file 'ofile' is no longer created,
as multiple output files were then introduced, while messages for
*expected errors* were redirected to a Makefile variable assignment
emitted on stdout, at which point the script just exits (in error);
expected failures only occur in do_validate().

Unexpected errors can only occur on failure to create, or write to,
output files, either '.br2-external.mk' in do_validate() or do_mk(),
or any of the kconfig fragments in do_kconfig(). Cause for failure to
create those can only be a no-space-left-on-device condition, as they
are created in a directory that was just created by the script earlier
in main(), and thus has the necessary mode; failure to create that
directory is now caught explicitly.

A trap on ERR is not called when the shell exits explicitly with a call
to 'exit', thus, only failures to create or write to output file would
be caught. In that case, we are better off not trying to write to those
files anyway: failure to create the file would already be reported by
the shell on stderr, while disk-full would not allow to store the output
anyway...

In any case, the script exits in error, which is going to be caught by
the caller, which will terminate.

So, drop the trap altogether.

As a side effect, that squelches a shellcheck error.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit 244e4283a9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:56:13 +01:00
Bernd Kuhls
3447410977 package/php: bump version to 8.5.4
https://www.php.net/ChangeLog-8.php#8.5.4
https://news-web.php.net/php.announce/486

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 712e3e10cf)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:56:11 +01:00
Bernd Kuhls
8ccf7b3887 package/libarchive: security bump version to 3.8.6
https://github.com/libarchive/libarchive/releases/tag/v3.8.6
"Libarchive 3.8.6 is a security and bugfix release."

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d950ff2488)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:56:09 +01:00
Bernd Kuhls
cfb1f63448 package/libcurl: security bump to version 8.19.0
https://curl.se/ch/8.19.0.html
https://curl.se/docs/security.html

Fixes the following CVEs:

CVE-2026-3805: use after free in SMB connection reuse
CVE-2026-3784: wrong proxy connection reuse with credentials
CVE-2026-3783: token leak with redirect and netrc
CVE-2026-1965: bad reuse of HTTP Negotiate connection

Switch to sha256 tarball hash provided by upstream.

Updated license hash due to copyright year bump:
e83c82f05f

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: add back pgp signature info in hash file]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 3a5e071e4f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:56:07 +01:00
Christian Stewart
cab7c3734e package/go: security bump to version 1.26.1
Building Go 1.26 and later requires Go 1.24.6 or later for bootstrap.

To support this we use Go version 1.25.8 as the version for
go-bootstrap-stage5 and have the build for Go 1.26.1 depend on
go-bootstrap-stage5.

Go version 1.25.8 is the latest Go version we can build using
go-bootstrap-stage4.

The package build for go-bootstrap-stage5 is effectively identical to
go-bootstrap-stage4 with only the Go version and stage number changed.

Go 1.28 is expected to require a minor release of Go 1.26 for bootstrap.

Fixes the following security vulnerabilities:

- CVE-2026-25679: net/url: reject IPv6 literal not at start of host
- CVE-2026-27142: html/template: URLs in meta attribute actions not escaped
- CVE-2026-27137: crypto/x509: incorrect enforcement of email constraints
- CVE-2026-27138: crypto/x509: panic in name constraint checking: certificates
- CVE-2026-27139: os: FileInfo can escape from a Root

For full release notes, see:
https://go.dev/doc/devel/release#go1.26.0

Signed-off-by: Christian Stewart <christian@aperture.us>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 43d1323196)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:56:05 +01:00
Julien Olivain
629bdb457b configs/aarch64_efi: switch to external toolchain
This commit switches the aarch64_efi_defconfig to an external glibc
stable Bootlin toolchain, to follow recommendation from [1].

Since an external toolchain is used, the linux-headers.hash custom
hash file is no longer needed and is removed.

[1] https://elinux.org/Buildroot:DeveloperDaysELCE2024#Rules_for_defconfigs

Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 18b8544235)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:56:03 +01:00
Julien Olivain
d9824ad5d9 support/testing: test_connman: new runtime test
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e55952b173)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:56:01 +01:00
Romain Naour
ea69fbb1ad boot/uboot: improve U-Boot OP-TEE TEE format options help text
OP-TEE generates a few binaries that can be used by u-boot on some
platforms (Rockchip, Texas Instruments K3) using TEE variable.

Add a link to the OP-TEE documentation were we can find easily the
desciption for each TEE format that can be used by u-boot.

For convenience, copy tee.elf and tee.bin description in each option
choice help text.

Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit a5f5c08dcd)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:55:59 +01:00
Marcus Hoffmann
8bdf79c098 DEVELOPERS: remove Marcus Hoffmann from no longer used packages
Remove myself from packages that I'm no longer personally interested in.

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 1210e4efeb)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:55:57 +01:00
Giulio Benetti
47e01beb12 package/nfs-utils: security bump version to 2.8.6
Release announce:
https://lore.kernel.org/linux-nfs/4d58bf28-a3e0-4496-bae8-05387da27054@redhat.com/

This update fixes:
https://www.cve.org/CVERecord?id=CVE-2025-12801

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 7dfd2feb44)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:55:55 +01:00
Giulio Benetti
1f053b6b85 package/nfs-utils: bump version to 2.8.5
Release announce:
https://lore.kernel.org/linux-nfs/fdf3631f-e924-4e4c-bd9f-db5b40a90bfe@redhat.com/

With patch [1] option nfsv41 required to be renamed to blkmapd.

[1]: https://git.linux-nfs.org/?p=steved/nfs-utils.git;a=commit;h=59e85671e59f7ccbf66dcf72ce7462bf4932cc78

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Reviewed-by: Petr Vorel <petr.vorel@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e7928fef42)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:55:53 +01:00
Titouan Christophe
44ba95ab09 {linux, linux-headers}: bump 6.12.x, 6.6.x, 6.1.x, 5.15.x, 5.10.x, 6.19.x, 6.18.x series
Update the latest kernel releases to:
 - 6.12.74 -> 6.12.77
 - 6.6.127 -> 6.6.129
 - 6.1.164 -> 6.1.166
 - 5.15.201 -> 5.15.202
 - 5.10.251 -> 5.10.252
 - 6.19.5 -> 6.19.8
 - 6.18.15 -> 6.18.18

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2026-03-16 15:13:51 +01:00
Bernd Kuhls
a6a9c1930e package/jasper: fix build without threads
Buildroot commit 03a1732dea bumped the
package from 2.0.33 to 4.2.8. This bump includes upstream commit
91fca09209
which was added to version 3.0.0 and causes build errors when threads
are not available:

    message(FATAL_ERROR "Threading support is not available.")

because JAS_ENABLE_MULTITHREADING_SUPPORT defaults to ON:
https://github.com/jasper-software/jasper/blob/version-4.2.8/CMakeLists.txt#L124

Add configure options to disable thread support when needed.

Fixes:
https://autobuild.buildroot.net/results/870/870d6adbac166b22cce217628d477b1bce538320/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d32b12b548)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:22:02 +01:00
Bernd Kuhls
d8dc041795 package/libheif: needs gcc >= 10
Fixes build error with gcc 9.x:

output/build/libheif-1.21.1/libheif/nclx.h:128:50: error:
 'bool nclx_profile::operator==(const nclx_profile&)
 const' cannot be defaulted

 using this defconfig:

  BR2_arm=y
  BR2_TOOLCHAIN_EXTERNAL=y
  BR2_TOOLCHAIN_EXTERNAL_CUSTOM=y
  BR2_TOOLCHAIN_EXTERNAL_DOWNLOAD=y
  BR2_TOOLCHAIN_EXTERNAL_URL="http://autobuild.buildroot.org/toolchains/tarballs/br-arm-full-static-2020.11.2.tar.bz2"
  BR2_TOOLCHAIN_EXTERNAL_GCC_9=y
  BR2_TOOLCHAIN_EXTERNAL_HEADERS_4_4=y
  BR2_TOOLCHAIN_EXTERNAL_LOCALE=y
  # BR2_TOOLCHAIN_EXTERNAL_HAS_THREADS_DEBUG is not set
  BR2_TOOLCHAIN_EXTERNAL_CXX=y
  BR2_STATIC_LIBS=y
  BR2_PACKAGE_LIBHEIF=y

According to https://github.com/strukturag/libheif/issues/1615#issuecomment-3457979167
gcc >= 10 with support for C++20 is needed for the package.

The failing code was introduced upstream in version 0.21.0 with commit
a62f933e38
which was added to buildroot with commit
a8aed698c7.

Also removed -std=c++11 from CXXFLAGS.

The build error was not yet recorded by the autobuilders.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 7323bcc1d4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:21:17 +01:00
Bernd Kuhls
9c2ea8a463 package/libvips: fix static build
Buildroot commit 72c7d99e22 switched the
build system to meson which causes an error during configure:

output/build/libvips-8.17.2/meson.build:108:4:
 ERROR: Problem encountered: GModule is not supported on your system,
 please reconfigure with -Dmodules=disabled

using this defconfig:

  BR2_arm=y
  BR2_TOOLCHAIN_EXTERNAL=y
  BR2_TOOLCHAIN_EXTERNAL_CUSTOM=y
  BR2_TOOLCHAIN_EXTERNAL_DOWNLOAD=y
  BR2_TOOLCHAIN_EXTERNAL_URL="http://autobuild.buildroot.org/toolchains/tarballs/br-arm-full-static-2020.11.2.tar.bz2"
  BR2_TOOLCHAIN_EXTERNAL_GCC_9=y
  BR2_TOOLCHAIN_EXTERNAL_HEADERS_4_4=y
  BR2_TOOLCHAIN_EXTERNAL_LOCALE=y
  # BR2_TOOLCHAIN_EXTERNAL_HAS_THREADS_DEBUG is not set
  BR2_TOOLCHAIN_EXTERNAL_CXX=y
  BR2_STATIC_LIBS=y
  BR2_PACKAGE_LIBVIPS=y

Added configure options for -Dmodules to fix the problem which was not
yet caught by the autobuilders.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 86d0fcd77b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:17:19 +01:00
Shubham Chakraborty
40f1d20242 package/python3: remove nis and ossaudiodev modules
These modules were dropped in Python 3.13 as per PEP 594.
The current version in Buildroot is 3.14.3.

- Remove the TODO and related config overrides in python3.mk.
- Remove BR2_PACKAGE_PYTHON3_OSSAUDIODEV from Config.in.
- Add BR2_PACKAGE_PYTHON3_OSSAUDIODEV to Config.in.legacy.

See [1] [2] [3].

[1] https://peps.python.org/pep-0594/
[2] fc07fe4e37
[3] 17e1fe0f9b

Signed-off-by: Shubham Chakraborty <chakrabortyshubham66@gmail.com>
[Julien:
 - add links in commit log
 - move legacy option in 2026.05 section
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit df6e7a6664)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:16:11 +01:00
Bernd Kuhls
a3fa3e9cd7 package/faketime: fix host build with glibc 2.43
Fixes:
https://autobuild.buildroot.net/results/911/9112933e2560b155a9c61f321874ec245b62b2a5/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 088c3602fd)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:11:29 +01:00
Bernd Kuhls
254712b12a package/docker: Fix build with gcc-15.x
Add patch from Debian to fix build error with gcc-15.x

Fixes:
https://autobuild.buildroot.net/results/495/4956555fd033d43c1877e66141789bcd06aff5be/

Patch sent to fork which is used by Arch Linux:
https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=wmdocker

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit cc3647e73f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:11:04 +01:00
Bernd Kuhls
70302f9267 package/postgresql: bump version to 18.3
https://www.postgresql.org/about/news/postgresql-183-179-1613-1517-and-1422-released-3246/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Reviewed-by: Maxim Kochetkov <fido_max@inbox.ru>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d62b605c1a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:10:17 +01:00
Bernd Kuhls
bbbad699ae DEVELOPERS: remove Bernd Kuhls from libldns
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 156e2be96c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:09:57 +01:00
Dowan Gullient
4e594d0eda support/testing/infra: update artifacts URL to https and .org domain
The artifacts URL has been moved to https and domain to .org to
improve security and avoid redirection issues. This ensures that
downloads of kernels and rootfs images during runtime tests are
encrypted and verified.

The change has been tested by running a runtime test, confirming the
correct download and renaming of artifacts from the new URL:

    Downloading to .../tmpyotq8uor
    Renaming from .../tmpyotq8uor to .../kernel-versatile-5.10.202

Signed-off-by: Dowan Gullient <dowan.gullient@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 8313d8a2fa)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:06:47 +01:00
Bernd Kuhls
3bfce36750 package/libtpms: security bump version to 0.10.2
https://github.com/stefanberger/libtpms/blob/v0.10.2/CHANGES

Fixes CVE-2026-21444.

Added comment to hash file about locally computed hashes.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit b1c4276c2d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:04:46 +01:00
Bernd Kuhls
60d110ac8d package/libtpms: fix build with host gcc >= 15.x, glibc >= 2.43
Fixes:
https://autobuild.buildroot.net/results/7a6/7a6ea7c513e8f1dcc32d868108bfb2a907d6fe85/

The previous change to src/tpm_library.c dates back to 2024:
https://github.com/stefanberger/libtpms/commits/master/src/tpm_library.c
so a backport to buildroot LTS branches should be considered.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: reword title to mention glibc 2.43]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f773fd6787)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:03:42 +01:00
Julien Olivain
b2dedc5541 support/testing: boot/test_grub: remove 32bit EFI test
EDK2 removed OVMF IA32 support in commit [1], which is included in
version edk2-stable202511. This commit removes the test relying on it.

[1] 1fb88ffe28

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit bd06eace37)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:03:16 +01:00
Julien Olivain
d0d88a9d47 support/testing: fs/test_iso9660: remove 32bit EFI tests
EDK2 removed OVMF IA32 support in commit [1], which is included in
version edk2-stable202511. This commit removes tests relying on it.

[1] 1fb88ffe28

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit cf16e1abe0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:02:53 +01:00
Bernd Kuhls
9f755efa4b package/clamav: security bump version to 1.5.2
https://blog.clamav.net/2026/03/clamav-152-and-144-security-patch.html

Fixes CVE-2026-20031: https://www.cve.org/CVERecord?id=CVE-2026-20031

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d225a6ffad)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:02:24 +01:00
Bernd Kuhls
47addd38d2 package/exiv2: security bump version to 0.28.8
https://exiv2.org/whatsnew.html
https://github.com/Exiv2/exiv2/blob/v0.28.8/doc/ChangeLog

This release fixes three low-severity vulnerabilities:

CVE-2026-25884: Out-of-bounds read in CrwMap::decode0x0805
CVE-2026-27596: Integer overflow in LoaderNative::getData() causes out-of-bounds read
CVE-2026-27631: Uncaught exception: cannot create std::vector larger than max_size()

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 1c3aa5f977)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:01:53 +01:00
Bernd Kuhls
69c4221f25 package/freetype: security bump version to 2.14.2
Release notes:
https://sourceforge.net/projects/freetype/files/freetype2/2.14.2/

Fixes CVE-2026-23865: https://seclists.org/oss-sec/2026/q1/253

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 6c3933d14b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:01:05 +01:00
Adrian Perez de Castro
2ea2018960 package/libsoup3: security bump to 3.6.6
While there is only one CVE number assigned (CVE-2025-14523) for one of
the patches included in this release, the bulk of the the changes are
security fixes.

Release notes may be found at:

  25eac15300

Fixes:
https://www.cve.org/CVERecord?id=CVE-2025-14523

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 1a9998e511)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:00:36 +01:00
Peter Korsgaard
52ee2f5644 Update for 2026.02
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2026.02
2026-03-04 09:11:17 +01:00
James Hilliard
346d6667fe package/ruby: disable zjit for all builds
The zjit option introduces a rust dependency and due to that not
being handled appropriately it can cause build failures if this
feature gets incorrectly autodetected as being available.

This feature was introduced when ruby was bumped to version 4.0.0
in f594f86f9d.

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2026-03-03 22:48:19 +01:00
Neal Frager
64083817de board/xilinx/arm-trusted-firmware.hash: add license file hashes
Now that custom arm-trusted-firmware versions can specify license files, add
license file hashes for the Xilinx custom arm-trusted-firmware version.

Signed-off-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2026-03-03 22:05:43 +01:00
Neal Frager
38486b310d board/xilinx/linux.hash: add license file hashes
Now that custom Linux versions can specify license files, add license file
hashes for the Xilinx custom Linux version.

Signed-off-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2026-03-03 22:05:36 +01:00
William Sherrer
166ef8a12c package/ruby: fix extension dependency after bump to 4.0.1
Commit 127f36b406 ("package/ruby: bump to version 4.0.1") adjusted
RUBY_VERSION_EXT, but ruby 4.0.1 still installs its extensions into the
4.0.0 subdir:

ls target/usr/lib/ruby/
4.0.0  site_ruby  vendor_ruby

So revert the RUBY_VERSION_EXT change to ensure the unneeded extensions are
correctly removed.

Signed-off-by: William Sherrer <william@sherrer.com>
[Peter: significantly extend commit message]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2026-03-03 21:46:12 +01:00
Thomas Perale
6f9f9caa45 package/graphicsmagick: add patch for CVE-2025-27796
Fixes the following vulnerability:

- CVE-2025-27796:
    ReadWPGImage in WPG in GraphicsMagick before 1.3.46 mishandles palette
    buffer allocation, resulting in out-of-bounds access to heap memory in
    ReadBlob.

For more information, see
  - https://www.cve.org/CVERecord?id=CVE-2025-27796
  - https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/883ebf8cae6dfa5873d975fe3476b1a188ef3

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-03 18:30:15 +01:00
Thomas Perale
5c03ddb286 package/graphicsmagick: add CVE-2007-0770 to IGNORE_CVES
This vulnerability match on every version of graphicsmagick [1].
It was issued because of an incomplete patch for CVE-2006-5456 and has
been since remediated [2].

Since it's really old it's unlikely it will be updated and is thus added
to IGNORE_CVES.

[1] https://nvd.nist.gov//vuln/detail/CVE-2007-0770
[2] https://bugzilla.redhat.com/show_bug.cgi?id=210921#c5

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-03 18:30:15 +01:00
Thomas Perale
b55fd37919 package/graphicsmagick: add CVE-2008-6621 to IGNORE_CVES
This vulnerability match on every version of graphicsmagick. Since it's
really old it's unlikely it will be updated and is thus added to
IGNORE_CVES. See [1].

[1] https://nvd.nist.gov//vuln/detail/CVE-2008-6621

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-03 18:30:15 +01:00
Thomas Perale
8d184e5504 package/freerdp: patch various vulnerabilities
Patches mostly backported with the basis of the work of Ubuntu Security
team. See [1].

Fix the following vulnerabilities:

- CVE-2024-32661:
    FreeRDP is a free implementation of the Remote Desktop Protocol.
    FreeRDP based clients prior to version 3.5.1 are vulnerable to a
    possible `NULL` access and crash. Version 3.5.1 contains a patch for
    the issue. No known workarounds are available.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2024-32661

- CVE-2026-23530:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior
    to version 3.21.0,`freerdp_bitmap_decompress_planar` does not validate
    `nSrcWidth`/`nSrcHeight` against `planar->maxWidth`/`maxHeight` before
    RLE decode. A malicious server can trigger a client‑side heap buffer
    overflow, causing a crash (DoS) and potential heap corruption with
    code‑execution risk depending on allocator behavior and surrounding
    heap layout. Version 3.21.0 contains a patch for the issue.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2026-23530

- CVE-2026-23531:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior
    to version 3.21.0, in ClearCodec, when `glyphData` is present,
    `clear_decompress` calls `freerdp_image_copy_no_overlap` without
    validating the destination rectangle, allowing an out-of-bounds
    read/write via crafted RDPGFX surface updates. A malicious server can
    trigger a client‑side heap buffer overflow, causing a crash (DoS) and
    potential heap corruption with code‑execution risk depending on
    allocator behavior and surrounding heap layout. Version 3.21.0
    contains a patch for the issue.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2026-23531

- CVE-2026-23532:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior
    to version 3.21.0, a client-side heap buffer overflow occurs in the
    FreeRDP client’s `gdi_SurfaceToSurface` path due to a mismatch between
    destination rectangle clamping and the actual copy size. A malicious
    server can trigger a client‑side heap buffer overflow, causing a crash
    (DoS) and potential heap corruption with code‑execution risk depending
    on allocator behavior and surrounding heap layout. Version 3.21.0
    contains a patch for the issue.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2026-23532

- CVE-2026-23533:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior
    to version 3.21.0, a client-side heap buffer overflow occurs in the
    RDPGFX ClearCodec decode path when maliciously crafted residual data
    causes out-of-bounds writes during color output. A malicious server
    can trigger a client‑side heap buffer overflow, causing a crash (DoS)
    and potential heap corruption with code‑execution risk depending on
    allocator behavior and surrounding heap layout. Version 3.21.0
    contains a patch for the issue.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2026-23533

- CVE-2026-23534:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior
    to version 3.21.0, a client-side heap buffer overflow occurs in the
    ClearCodec bands decode path when crafted band coordinates allow
    writes past the end of the destination surface buffer. A malicious
    server can trigger a client‑side heap buffer overflow, causing a crash
    (DoS) and potential heap corruption with code‑execution risk depending
    on allocator behavior and surrounding heap layout. Version 3.21.0
    contains a patch for the issue.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2026-23534

- CVE-2026-23948:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior
    to 3.22.0, a NULL pointer dereference vulnerability in
    rdp_write_logon_info_v2() allows a malicious RDP server to crash
    FreeRDP proxy by sending a specially crafted LogonInfoV2 PDU with
    cbDomain=0 or cbUserName=0. This vulnerability is fixed in 3.22.0.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2026-23948

- CVE-2026-24675:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior
    to 3.22.0, urb_select_interface can free the device's MS config on
    error but later code still dereferences it, leading to a use after
    free in libusb_udev_select_interface. This vulnerability is fixed in
    3.22.0.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2026-24675

- CVE-2026-24676:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior
    to 3.22.0, AUDIN format renegotiation frees the active format list
    while the capture thread continues using audin->format, leading to a
    use after free in audio_format_compatible. This vulnerability is fixed
    in 3.22.0.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2026-24676

- CVE-2026-24679:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior
    to 3.22.0, The URBDRC client uses server-supplied interface numbers as
    array indices without bounds checks, causing an out-of-bounds read in
    libusb_udev_select_interface. This vulnerability is fixed in 3.22.0.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2026-24679

- CVE-2026-24681:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior
    to 3.22.0, aAsynchronous bulk transfer completions can use a freed
    channel callback after URBDRC channel close, leading to a use after
    free in urb_write_completion. This vulnerability is fixed in 3.22.0.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2026-24681

- CVE-2026-24682:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior
    to 3.22.0, audin_server_recv_formats frees an incorrect number of
    audio formats on parse failure (i + i), leading to out-of-bounds
    access in audio_formats_free. This vulnerability is fixed in 3.22.0.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2026-24682

- CVE-2026-24683:
    FreeRDP is a free implementation of the Remote Desktop Protocol.
    ainput_send_input_event caches channel_callback in a local variable
    and later uses it without synchronization; a concurrent channel close
    can free or reinitialize the callback, leading to a use after free.
    Prior to 3.22.0, This vulnerability is fixed in 3.22.0.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2026-24683

[1] https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/freerdp2/2.6.1+dfsg1-3ubuntu2.10/freerdp2_2.6.1+dfsg1-3ubuntu2.10.debian.tar.xz

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-03 18:25:22 +01:00
Thomas Perale
dc8fc4b803 package/freerdp: add CVE-2025-68118 to IGNORE_CVES
Only affects Windows platform. See [1] for more information.

[1] https://security-tracker.debian.org/tracker/CVE-2025-68118

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-03 18:25:22 +01:00
Thomas Perale
a3329fd492 package/freerdp: add CVE-2024-32662 to IGNORE_CVES
The CVE-2024-32662 was Introduced in v3.0.0-beta1.
For more information see [1].

[1] https://security-tracker.debian.org/tracker/CVE-2024-32662

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-03 18:25:22 +01:00
Thomas Perale
73861bb720 package/freerdp: bump to v2.11.8
For more information on the release, see:

- 9b678b6d5a
- https://github.com/FreeRDP/FreeRDP/releases/tag/2.11.8
- https://github.com/FreeRDP/FreeRDP/compare/2.11.7...2.11.8

Note: the previous freerdp version 2.11.7-18-g0ee17e2f in Buildroot
is only 5 commits prior the 2.11.8 tag. This is a very minimal bump.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
[Julien: add note in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-03 18:25:22 +01:00
Thomas Perale
8918f1c2c8 package/squid: add patch for CVE-2025-62168
Fixes the following vulnerability:

- CVE-2025-62168:
    Squid is a caching proxy for the Web. In Squid versions prior to 7.2,
    a failure to redact HTTP authentication credentials in error handling
    allows information disclosure. The vulnerability allows a script to
    bypass browser security protections and learn the credentials a
    trusted client uses to authenticate. This potentially allows a remote
    client to identify security tokens or credentials used internally by a
    web application using Squid for backend load balancing. These attacks
    do not require Squid to be configured with HTTP authentication. The
    vulnerability is fixed in version 7.2. As a workaround, disable debug
    information in administrator mailto links generated by Squid by
    configuring squid.conf with email_err_data off.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2025-62168
  - 0951a06810

The backport has been compared against debian patch [1].

[1] https://sources.debian.org/src/squid/6.13-2%2Bdeb13u1/debian/patches/CVE-2025-62168.patch

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-03 18:22:52 +01:00
Thomas Perale
95dad8f85c package/vim: security bump to v9.1.2148
For changes, see:

  - https://github.com/vim/vim/compare/v9.1.2017...v9.1.2148

Fixes the following vulnerabilities:

- CVE-2026-25749:
    Vim is an open source, command line text editor. Prior to version
    9.1.2132, a heap buffer overflow vulnerability exists in Vim's tag
    file resolution logic when processing the 'helpfile' option. The
    vulnerability is located in the get_tagfname() function in src/tag.c.
    When processing help file tags, Vim copies the user-controlled
    'helpfile' option value into a fixed-size heap buffer of MAXPATHL + 1
    bytes (typically 4097 bytes) using an unsafe STRCPY() operation
    without any bounds checking. This issue has been patched in version
    9.1.2132.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2026-25749
  - 0714b15940

- CVE-2026-26269:
    Vim is an open source, command line text editor. Prior to 9.1.2148, a
    stack buffer overflow vulnerability exists in Vim's NetBeans
    integration when processing the specialKeys command, affecting Vim
    builds that enable and use the NetBeans feature. The Stack buffer
    overflow exists in special_keys() (in src/netbeans.c). The while
    (*tok) loop writes two bytes per iteration into a 64-byte stack buffer
    (keybuf) with no bounds check. A malicious NetBeans server can
    overflow keybuf with a single specialKeys command. The issue has been
    fixed as of Vim patch v9.1.2148.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2026-26269
  - c5f312aad8

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-03 18:19:57 +01:00
Peter Korsgaard
8195c73ca3 Update for 2026.02-rc3
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2026.02-rc3
2026-03-02 13:11:23 +01:00
Peter Korsgaard
311e5cdc51 support/testing/run-tests: unbreak on Debian testing/unstable
Commit 3d2141bcee("support/testing/run-tests: specify multiprocessing
method") added a call to multiprocessing.set_start_method('fork') as a
workaround for python 3.14, which changed the default start method to
forkserver - Which is incompatible with the nose2 setup.

multiprocessing.set_start_method() is only supposed to be called a maximum
of 1 time per process and throws a RuntimeError if called more than that
(even with the same arguments):

>>> import multiprocessing
>>> multiprocessing.set_start_method('fork')
>>> multiprocessing.set_start_method('fork')
Traceback (most recent call last):
  File "<python-input-2>", line 1, in <module>
    multiprocessing.set_start_method('fork')
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^
  File "/usr/lib/python3.13/multiprocessing/context.py", line 247, in set_start_method
    raise RuntimeError('context has already been set')

Debian included a similar patch in python3-nose2 0.51.1-2 (currently in
testing/unstable) which adds its own call to set_start_method():

https://salsa.debian.org/python-team/packages/nose2/-/blob/debian/0.15.1-2/debian/patches/0004-plugins-mp-set-context-to-fork-for-Python-3.14-mp-AP.patch?ref_type=tags

Which comes from:
https://github.com/nose-devs/nose2/pull/644

As discussed in the upstream PR, this is not a correct fix is wrong and
breaks various use cases.  An issue has been opened to get this fixed in the
Debian packaging at:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1129350

But until that is done, rework the patch to:

- Only override set_start_method() if needed to limit impact
- Monkey patch set_start_method() so additional calls are ignored

To unbreak run-test on affected Debian systems and add some documentation to
make it clear why this is done.

[Peter: use allow_none / force optional arguments as pointed out by Julien]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2026-03-02 12:11:51 +01:00
Alexis Lothoré
093725864a package/openscap: add patch to enforce project as C project
When the toolchain involved in openscap build does not support C++, the
configure step fails with the following error:

  -- Detecting CXX compiler ABI info
  -- Detecting CXX compiler ABI info - failed
  -- Check for working CXX compiler: /bin/false
  -- Check for working CXX compiler: /bin/false - broken
  CMake Error at /usr/share/cmake/Modules/CMakeTestCXXCompiler.cmake:73 (message):
    The C++ compiler

      "/bin/false"

    is not able to compile a simple test program.

    It fails with the following output:

      Change Dir: '/home/autobuild/autobuild/instance-6/output-1/build/openscap-1.3.12/buildroot-build/CMakeFiles/CMakeScratch/TryCompile-tUydqI'

      Run Build Command(s): /usr/bin/cmake -E env VERBOSE=1 /usr/bin/make -f Makefile cmTC_1834b/fast
      make[1]: Entering directory '/home/autobuild/autobuild/instance-6/output-1/build/openscap-1.3.12/buildroot-build/CMakeFiles/CMakeScratch/TryCompile-tUydqI'
      /usr/bin/make  -f CMakeFiles/cmTC_1834b.dir/build.make CMakeFiles/cmTC_1834b.dir/build
      make[2]: Entering directory '/home/autobuild/autobuild/instance-6/output-1/build/openscap-1.3.12/buildroot-build/CMakeFiles/CMakeScratch/TryCompile-tUydqI'
      Building CXX object CMakeFiles/cmTC_1834b.dir/testCXXCompiler.cxx.o /bin/false    -o CMakeFiles/cmTC_1834b.dir/testCXXCompiler.cxx.o -c /home/autobuild/autobuild/instance-6/output-1/build/openscap-1.3.12/buildroot-build/CMakeFiles/CMakeScratch/TryCompile-tUydqI/testCXXCompiler.cxx
      make[2]: *** [CMakeFiles/cmTC_1834b.dir/build.make:81: CMakeFiles/cmTC_1834b.dir/testCXXCompiler.cxx.o] Error 1
      make[2]: Leaving directory '/home/autobuild/autobuild/instance-6/output-1/build/openscap-1.3.12/buildroot-build/CMakeFiles/CMakeScratch/TryCompile-tUydqI'
      make[1]: *** [Makefile:134: cmTC_1834b/fast] Error 2
      make[1]: Leaving directory '/home/autobuild/autobuild/instance-6/output-1/build/openscap-1.3.12/buildroot-build/CMakeFiles/CMakeScratch/TryCompile-tUydqI'

    CMake will not be able to correctly generate this project.
  Call Stack (most recent call first):
    CMakeLists.txt:11 (project)

  -- Configuring incomplete, errors occurred!
  make: *** [package/pkg-generic.mk:263: /home/autobuild/autobuild/instance-6/output-1/build/openscap-1.3.12/.stamp_configured] Error 1
  make: Leaving directory '/home/autobuild/autobuild/instance-6/buildroot'

The openscap project does not contain any C++ file, and so does not need
a C++ capable compiler. Bring the to-be-integrated-upstream patch
enforcing C language in CMakeLists.txt to prevent this build failure.

Fixes: https://autobuild.buildroot.org/results/1fe550ffa79f0a083a450ae03fe067a8ab7336be
Fixes: https://autobuild.buildroot.org/results/e9d52b52658544916022050c78dcb137ca6c97e0
Fixes: https://autobuild.buildroot.org/results/4a9c21763aaddb217ee5f8bb8947faad9767baa3
Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
Reviewed-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2026-03-02 10:32:59 +01:00
Adrian Perez de Castro
156e5fa7eb package/webkitgtk: bump to version 2.50.5
Fixes a number of crashes. Release notes:

  https://webkitgtk.org/2026/02/09/webkitgtk2.50.5-released.html

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2026-03-02 10:28:25 +01:00