Commit Graph

83506 Commits

Author SHA1 Message Date
Raphaël Mélotte
ee301c0b16 package/gumbo-parser: switch to Git download
Codeberg has changed the way it generate hashes for at least some of
the generated tarballs (see [1]). Since we cannot update the hash
without changing the file name, we switch to Git download in order to
have a different file name.

[1]: https://codeberg.org/Codeberg/Community/issues/2861

Fixes:

  https://autobuild.buildroot.net/results/7e4e5d6f1ba4222306cd88944b39a75c730db771/

Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit bde76bfe85)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 15:12:37 +02:00
Yegor Yefremov
66eaacb941 package/atop: fix musl build
Since the bump to version 2.13.0 in Buildroot commit [1],
atop fails to build with musl:

drawbar.c:2336:33: error: implicit declaration of function 'waddwstr'; did you mean 'waddstr'? [-Wimplicit-function-declaration]

(Before 2.13.0, the same configurations already failed earlier on
uClibc because _POSIX_C_SOURCE was defined without a value. Upstream
fixed that in 2.13.0 by giving it an explicit value, but the same
pattern remains for _XOPEN_SOURCE.)

ncurses only declares its wide-character API, including waddwstr(),
when NCURSES_WIDECHAR is set. If the application does not set it,
curses.h derives it from the feature test macros:

  #if defined(_XOPEN_SOURCE_EXTENDED) || \
      (defined(_XOPEN_SOURCE) && (_XOPEN_SOURCE - 0 >= 500))

drawbar.c defines _XOPEN_SOURCE with an empty value, which makes the
check evaluate as 0 >= 500 and fail.

This only breaks with musl because of the C library's <features.h>,
which curses.h pulls in through <stdio.h> before doing the check.
glibc and uClibc both redefine _XOPEN_SOURCE to 700 and define
_XOPEN_SOURCE_EXTENDED whenever _GNU_SOURCE is set, which drawbar.c
does, so the empty definition gets fixed up. musl never modifies the
application's feature test macros, so the empty value reaches
curses.h and the wide-character prototypes are left out.

Add a patch that defines _XOPEN_SOURCE as 700, matching the
_POSIX_C_SOURCE value of 200809L that is already used.

Fixes:
 - https://autobuild.buildroot.org/results/914c1d8fa0fc8bbef64e4a64d58e5941d0077a3e
 - https://autobuild.buildroot.org/results/b91ea0722202de0d1fdeeaeea167fd1b21b6d5d6

[1] 2110131cab

Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Tested-By: Thomas Perale <thomas.perale@mind.be>
[Julien: add link to Buildroot commit introducing the issue]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 99909a8a95)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:36:19 +02:00
Cherniaev Andrei
7baaf34fa5 boot/edk2: extend help text
Signed-off-by: Cherniaev Andrei <dungeonlords789@naver.com>
Reviewed-by: Kory Maincent <kory.maincent@bootlin.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit ea0f27d64f)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:36:17 +02:00
Peter Korsgaard
4ff6a490e3 package/pkg-generic.mk: drop PKGDIR variable for {, actual-}source step
This was added in commit 2d4fd5d358 ("pkg-infra: also set PKGDIR for the
download step") for the DOWNLOAD macro, which was reworked in commit
155f752d8a ("core/download: do not hard-code the path to the package hash
file") to instead use <FOO>_HASH_FILE, so drop it.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit f454580f0f)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:36:11 +02:00
Peter Korsgaard
d4da32b15c package/pkg-generic.mk: drop PKGDIR variable for patch step
This was added in commit 604d261fb0 ("infra: remove variable
FOO_DIR_PREFIX") to figure out where to find patches, but this was reworked
in commit 99d4180eda ("package/pkg-generic.mk: factor out patch
directories") to instead use <FOO>_PKGDIR, so drop it.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 5c668c42e2)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:36:08 +02:00
Peter Korsgaard
c82b49c285 package/pkg-generic.mk: drop RAWNAME variable
This was added in commit 7a41cbf938 ("package: fix patching procedure for
host packages") to figure out where to find patches, but this was reworked
in commit 99d4180eda ("package/pkg-generic.mk: factor out patch
directories") to instead use <FOO>_RAWNAME, so drop it.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit ade0757d7f)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:36:04 +02:00
Yegor Yefremov
0b98157406 package/haveged: needs threads
Since the bump to version 1.9.15 in commit
2a28d25d0c ("package/haveged: bump to version 1.9.15"), haveged
unconditionally includes <semaphore.h> and uses named semaphores
(sem_open() and friends) to synchronize command instances. As a
result, the build fails with toolchains without threads support:

haveged.c:37:10: fatal error: semaphore.h: No such file or directory

Add a dependency on BR2_TOOLCHAIN_HAS_THREADS. Since threads are now
always available, unconditionally pass --enable-threads.

Fixes:
  https://autobuild.buildroot.org/results/814cb7b5537d8b7b2c23f3d90e37b2b41de7ee3f

Fixes: 2a28d25d0c ("package/haveged: bump to version 1.9.15")
Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit cec5f7af80)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:36:00 +02:00
Sebastien Guillaume
af0cac3258 package/x11r7/xkeyboard-config: add CPE
The resulting CPE ID is:

cpe:2.3:a:xkeyboard_config_project:xkeyboard-config:2.38:-:*:*:*:*:*:*

The vendor and product are valid, see e.g.
https://nvd.nist.gov/vuln/detail/CVE-2012-0064

Signed-off-by: Sebastien Guillaume <sebastien.guillaume@vendeeconcept.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 6a625034ca)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:35:56 +02:00
Sebastien Guillaume
30122f7a12 package/seatd: add CPE
The resulting CPE ID is:

cpe:2.3:a:seatd_project:seatd:0.9.1:-:*:*:*:*:*:*

The vendor and product are valid, see e.g.
https://nvd.nist.gov/vuln/detail/CVE-2021-41387

Signed-off-by: Sebastien Guillaume <sebastien.guillaume@vendeeconcept.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 763dcabf6d)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:35:52 +02:00
Sebastien Guillaume
83eaa5f8b6 package/qt6/qt6svg: add CPE
The resulting CPE ID is:

cpe:2.3:a:qt:qtsvg:6.11.2:-:*:*:*:*:*:*

The vendor and product are valid, see e.g.
https://nvd.nist.gov/vuln/detail/CVE-2021-45930

Signed-off-by: Sebastien Guillaume <sebastien.guillaume@vendeeconcept.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 6d335ea39f)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:35:48 +02:00
Sebastien Guillaume
8ad5be182c package/qt6/qt6declarative: add CPE
The resulting CPE ID is:

cpe:2.3:a:qt:qtdeclarative:6.11.2:-:*:*:*:*:*:*

The vendor and product are valid, see e.g.
https://nvd.nist.gov/vuln/detail/CVE-2025-14576

Signed-off-by: Sebastien Guillaume <sebastien.guillaume@vendeeconcept.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit ef0f032677)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:35:45 +02:00
Sebastien Guillaume
1cde8415af package/patchelf: add CPE
The resulting CPE ID is:

cpe:2.3:a:patchelf_project:patchelf:0.13:-:*:*:*:*:*:*

The vendor and product are valid, see e.g.
https://nvd.nist.gov/vuln/detail/CVE-2022-44940

Signed-off-by: Sebastien Guillaume <sebastien.guillaume@vendeeconcept.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit ee8a99137d)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:35:40 +02:00
Sebastien Guillaume
48a296c33c package/nano: add CPE
The resulting CPE ID is:

cpe:2.3:a:gnu:nano:9.2:-:*:*:*:*:*:*

The vendor and product are valid, see e.g.
https://nvd.nist.gov/vuln/detail/CVE-2026-6843

Signed-off-by: Sebastien Guillaume <sebastien.guillaume@vendeeconcept.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit a07499c8f1)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:35:36 +02:00
Sebastien Guillaume
fde871cb3a package/m4: add CPE
The resulting CPE ID is:

cpe:2.3:a:gnu:m4:1.4.21:-:*:*:*:*:*:*

The vendor and product are valid, see e.g.
https://nvd.nist.gov/vuln/detail/CVE-2008-1687

Signed-off-by: Sebastien Guillaume <sebastien.guillaume@vendeeconcept.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 7fa4b3c8b4)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:35:32 +02:00
Sebastien Guillaume
43bcd4d4de package/kbd: add CPE
The resulting CPE ID is:

cpe:2.3:a:kbd-project:kbd:2.10.0:-:*:*:*:*:*:*

The vendor and product are valid, see e.g.
https://nvd.nist.gov/vuln/detail/CVE-2011-0460

Signed-off-by: Sebastien Guillaume <sebastien.guillaume@vendeeconcept.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 93df82900d)
[raphael: resolve conflict]
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:34:01 +02:00
Raphaël Mélotte
e20d53bb75 package/kbd: reorder .mk variables
We usually put the metadata variables at the beginning of the file and
the variables related to how to build it (like _CONF_OPTS) later.  Apply
this principle.

(alternative to commit 35dc65563d)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:30:16 +02:00
Sebastien Guillaume
06485a7867 package/htop: add CPE
The resulting CPE ID is:

cpe:2.3:a:htop:htop:3.5.1:-:*:*:*:*:*:*

The vendor and product are valid, see e.g.
https://nvd.nist.gov/vuln/detail/CVE-2008-5076

Signed-off-by: Sebastien Guillaume <sebastien.guillaume@vendeeconcept.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 444d769c0a)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:12:14 +02:00
Sebastien Guillaume
d4acf5377e package/gcc/gcc-initial: add CPE
gcc-final already had a CPE.

The resulting CPE ID is:

cpe:2.3:a:gnu:gcc:15.3.0:-:*:*:*:*:*:*

The vendor and product are valid, see e.g.
https://nvd.nist.gov/vuln/detail/CVE-2019-15847

Signed-off-by: Sebastien Guillaume <sebastien.guillaume@vendeeconcept.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 32d08d1945)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:12:08 +02:00
Sebastien Guillaume
736e6bb469 package/gawk: add CPE
The resulting CPE ID is:

cpe:2.3:a:gnu:gawk:5.4.1:-:*:*:*:*:*:*

The vendor and product are valid, see e.g.
https://nvd.nist.gov/vuln/detail/CVE-2023-4156

Signed-off-by: Sebastien Guillaume <sebastien.guillaume@vendeeconcept.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 2ee591714d)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:11:59 +02:00
Yegor Yefremov
265e33686b package/pkg-autotools.mk: also handle libtool 2.6.x
Fixes:
https://autobuild.buildroot.org/results/e6159cee14f84569c85a61f77824b2b58d68a4bc/

Libtool 2.6.x is starting to be used by upstreams when generating
release tarballs (e.g. cryptsetup-2.8.8). As LIBTOOL_PATCH_HOOK does
not know about it, ltmain.sh is left unpatched, so libtool relinks
libraries at install time and adds -L/usr/lib, which is rejected by
the toolchain wrapper:

i686-buildroot-linux-gnu-gcc: ERROR: unsafe header/library path used in cross-compilation: '-L/usr/lib'

The v2.4.4 patch no longer applies cleanly, so add a v2.6 variant,
rebased on libtool 2.6.2, and use it for 2.6.x versions.

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Assisted-by: Claude:claude-opus-5
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 5dbba2616f)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:11:55 +02:00
Thomas Petazzoni
23e6fb3ef2 package/sqlitecpp: fixup Config.in comment
Commit 8b651fd817 added a dependency on
gcc >= 4.9 and as part of that updated the Config.in comment to
mention C++11 instead of C++. This is not consistent with Buildroot
convention, where we only mention C++, and separately the GCC version
requirement. This commit aligns the Config.in comment with the
Buildroot convention.

Fixes: 8b651fd817 ("package/sqlitecpp: require C++11")
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 6c12e9327c)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:11:51 +02:00
Michael Nosthoff
a049d34e64 package/sqlitecpp: needs threads
SQLiteCpp has an unconditional dependency on threads.

fixes:
br-test-pkg/br-arm-full-nothread
https://gitlab.com/heinemml/buildroot/-/jobs/16865965420

The problem exists since the package was added in Buildroot.

Fixes: e74059b39c ("package/sqlitecpp: new package")
Signed-off-by: Michael Nosthoff <buildroot@heine.tech>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit ce4fc125fb)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:11:47 +02:00
Michael Nosthoff
aab81c2f63 package/sqlitecpp: disable stack protection
SQLiteCpp has an internal setting for stack protection which defaults
to "on". Since Buildroot handles stack protection itself this is not
needed and more importantly it causes problems as the option enables
stack protection support even when the toolchain doesn't support it,
as can be reproduced using the following defconfig:

BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_X86_I686_MUSL_BLEEDING_EDGE=y
BR2_PACKAGE_SQLITECPP=y

Fixes:
br-test-pkg/bootlin-x86-i686-musl
https://gitlab.com/heinemml/buildroot/-/jobs/16865965418

Oddly enough, there are no autobuilder failures recorded for this
issue.

Fixes: e74059b39c ("package/sqlitecpp: new package")
Signed-off-by: Michael Nosthoff <buildroot@heine.tech>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 39235638d1)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:11:43 +02:00
Michael Nosthoff
9d96d396ec support/testing: sqlitecpp: new runtime test
build and run an SQLiteCpp example to check database writes and queries.

Assisted-by: GitHub Copilot:GPT-6 Sol
Signed-off-by: Michael Nosthoff <buildroot@heine.tech>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 93c6c91955)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:11:39 +02:00
Thomas Petazzoni
95f448c511 utils/docker-run: add NO_NETWORK variable
It is sometimes useful to be able to do an offline build, to make sure
the build works properly without network access, so this commit adds a
NO_NETWORK environment variable to our docker-run script, which for
example allows to do:

$ ./utils/docker-run make source
$ NO_NETWORK=1 ./utils/docker-run make

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d6f816facc)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:11:34 +02:00
b7ef4f78cc docs/manual/writing-rules: align use of genimage partition types
Buildroot boards use a mixture of the GPT Partition Type "L" (generic
Linux filesystem) and "root-x86", "root-arm", etc (UAPI Root
Filesystem) for root filesystem partitions.

To have consistent guidance on building disk images with genimage,
update the docs to recommend using the UAPI Root Filesystem types. The
UAPI Root Filesystem types are part of the UAPI Discoverable Partitions
Specification (DPS) which helps set a wider standard for system boot.

See https://uapi-group.org/specifications/specs/discoverable_partitions_specification/

Signed-off-by: Brandon Maier <brandon.maier@gmail.com>
[Arnout: some additional rewording mainly based on input from Niklas
Cassel]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 529df0b580)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:11:31 +02:00
Francesco Mancino
f87d354fe6 package/linux-headers: pass --no-print-directory
Since commit 5fc10e76fa2a9 in linux v6.5-rc1, the kernel does a
recursive make call to add the --no-print-directory flag if it is not
set.

Buildroot sets MAKEOVERRIDES empty, which causes none of the
command-line overrides to be propagated to sub-makes. This only goes one
level deep, so it is not a problem. However, if the user sets
MAKEOVERRIDES in their environment, the environment _does_ get
propagated down to sub-makes. Therefore, the recursive call from within
the kernel will not get any of the command-line overrides we give it.
As a result, INSTALL_HDR_PATH will not get passed down to the kernel's
sub-make, thereby breaking the installation to staging.

Note that if Buildroot itself does a sub-make call (e.g. because O= is
set, or umask is different), --no-print-directory is already added so
the issue doesn't occur.

Set --no-print-directory explicitly, which avoids the kernel's sub-make
call, which preserves INSTALL_HDR_PATH. It is only really needed for the
staging install, since the local install in _CONFIGURE_CMDS just sets it
to the default value. For consistency though, set it there as well.

Setting --no-print-directory when it is not needed doesn't hurt.

Signed-off-by: Francesco Mancino <francesco.mancino@tutus.se>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 77faecb13a)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:11:26 +02:00
Bernd Kuhls
3f859c10af package/luvi: fix build without c++
Buildroot commit 00317f0aff bumped the
package to 2.15.0 which first included upstream commit
262d5f7dff
that added the miniz submodule.

The version of miniz used by luvi contains commit
05ab4dc05c
which removed "C" from the project variable causing a dependency to c++
which causes build errors when the toolchain does not support c++:

-- Check for working CXX compiler: /bin/false - broken

This dependency was not intended so we add an upstream commit to fix the
problem.

Fixes:
https://autobuild.buildroot.net/results/2a5/2a5cf09dc9303b11e2a2769c5b0b319284ec1bbb/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit d267b59fa9)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:11:22 +02:00
Bernd Kuhls
33ea536021 package/snort3: fix build error with numa support
Buildroot commit 5e78c6cf33 bumped the
package from 3.1.40.0 to 3.11.1.0. Upstream commit
83e9a2dda2
added numa support, first included in release 3.1.65.0.

This causes a build error due to the numactl package being pulled-in as
optional dependency by hwloc, the latter being a hard dependency of
snort3.

Fixes:
https://autobuild.buildroot.net/results/e8a/e8a9d787973fd109c07c185103de1f9f7339d506/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Cc: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 4fab16d9c2)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:11:16 +02:00
Joachim Wiberg
eca7314d34 DEVELOPERS: add Joachim Wiberg for firewalld
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 1613918710)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:11:14 +02:00
Yegor Yefremov
9c0c1eaca1 package/shadowsocks-libev: update the site URL to shadowsocks-c
The upstream repository was renamed from shadowsocks-libev to
shadowsocks-c. GitHub still redirects the old URL, but the README names
shadowsocks/shadowsocks-c as the canonical repository.

The v3.3.6 tag points to the same commit in the renamed repository, so
the tarball and its hash are unchanged.

See upstream commits:
bdc77408cb
bff687bd34

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Assisted-by: Claude:claude-opus-5
[Julien: add references to upstream commits renaming the project]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 0522d9af89)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:11:10 +02:00
Bernd Kuhls
c3ccc14629 package/go: security bump version to 1.27.2
https://go.dev/doc/devel/release#go1.27.2
https://groups.google.com/g/golang-announce/c/U2fTuyDJznI/m/bAPU-QKAAQAJ

Fixes CVE-2026-56857, CVE-2026-56866, CVE-2026-78659, CVE-2026-78660,
CVE-2026-78663, CVE-2026-78667, CVE-2026-78669, CVE-2026-94439,
CVE-2026-94440, CVE-2026-94444, CVE-2026-94447, CVE-2026-94448,
CVE-2026-97030, CVE-2026-97031 & CVE-2026-97032.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 6a9ea2a8bf)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:03:58 +02:00
Christian Stewart
f7a030038f package/go: new major version 1.27
Bump to go1.27.0. The go-bootstrap-stage5 package (go1.25.x) still
satisfies the bootstrap requirement, so no bootstrap stage changes are
needed.

Remove the workaround for https://github.com/golang/go/issues/77436,
which the go.mk comment scheduled for removal at this bump: restore the
plain CGO_CFLAGS and CGO_CXXFLAGS settings in HOST_GO_TARGET_ENV.

https://go.dev/doc/go1.27#bootstrap

Signed-off-by: Christian Stewart <christian@aperture.us>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 798741f4dc)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:03:21 +02:00
Bernd Kuhls
64b813b5b7 package/tor: security bump version to 0.4.9.14
https://gitlab.torproject.org/tpo/core/tor/-/blob/tor-0.4.9.14/ReleaseNotes?ref_type=tags

Fixes TROVE-2026-062, TROVE-2026-064 & TROVE-2026-067.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit dbf47e3028)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 13:30:22 +02:00
Bernd Kuhls
a6ff89cc79 package/expat: security bump version to 2.9.0
https://github.com/libexpat/libexpat/blob/R_2_9_0/expat/Changes
https://blog.hartwork.org/posts/expat-2-9-0-released/

Fixes CVE-2026-77214 & CVE-2026-102633.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit b6525e9cf8)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 13:30:06 +02:00
Bernd Kuhls
4afda3339a package/openvpn: security bump version to 2.7.8
https://github.com/OpenVPN/openvpn/blob/v2.7.8/Changes.rst

Fixes CVE-2026-84790 & CVE-2026-88964.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 43d55a6d9c)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 13:21:05 +02:00
Yegor Yefremov
cceed8a0ab utils/genrandconfig: reject qemu user mode on hosts with large pages
Qemu in user mode cannot load target binaries laid out for 4k pages
when the host uses larger pages, as the 16k pages of the Asahi Linux
kernel on Apple Silicon. The dynamic loader then fails with e.g.:

  GLib-2.0: error while loading shared libraries: libz.so.1: failed
  to map segment from shared object

or, depending on the target:

  qemu-aarch64: .../GLib-2.0: Error mapping file: Invalid argument
  torque: error while loading shared libraries: libz.so.1: ELF load
  command address/offset not page-aligned

This hits every package running target code through qemu at build
time, i.e. gobject-introspection and nodejs, on mips, sparc64 and
aarch64 alike, and is not something Buildroot can fix in the
packages themselves.

As this only depends on the build host, reject such configurations
in genrandconfig when the host page size is larger than 4k.

Fixes:
https://autobuild.buildroot.org/results/4848e735fe83dfeef4f24d32655c567951fd113a (mips)
https://autobuild.buildroot.org/results/089ddac5bdaaf5650cbc5c26d48952b5bede0ca6 (sparc64)
https://autobuild.buildroot.org/results/c30c6719a0350370ebe3cfe262123727f4057734 (aarch64)

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 721e51f58a)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 13:21:04 +02:00
Maxime Chevallier
ce829cad92 package/linux-tools: selftests: use KHDR_INCLUDES to locate the headers
Since v6.7 [1], the KHDR_DIR variable isn't used anymore by the kernel
selftest Makefiles to locate the kernel headers. Instead, KHDR_INCLUDES
is used to specify their location. It was only available between v6.5
and v6.7.

Keep KHDR_DIR for compatibility with v6.5 to v6.7 kernels, while
KHDR_INCLUDES is used by both pre 6.5 and post 6.7 kernels.

Let's pass it with the "-isystem" flag, as is done in the default values
used in the selftest makefiles.

[1]: 43e8832fed08 ("Revert "selftests: error out if kernel header files are not yet built"")

Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 716a715539)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 13:21:00 +02:00
Yegor Yefremov
6d90c8f535 package/inadyn: fix mbedtls support
Since commit 6bab22ca41 ("package/inadyn: bump to v2.10.0"), the
mbedtls condition is written as "$BR2_PACKAGE_MBEDTLS", which make
expands as the variable $B followed by "R2_PACKAGE_MBEDTLS", so the
condition is never true. Without OpenSSL and GnuTLS, inadyn was built
with --disable-ssl even when mbedtls was enabled.

In addition, inadyn uses GnuTLS by default and needs --enable-mbedtls
to use mbedtls, which was never passed.

Fix the condition and pass --enable-mbedtls.

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Assisted-by: Claude:claude-opus-5
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 23d71bfd96)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 13:20:56 +02:00
Peter Seiderer
737f6f0222 package/openssh: security bump version to 10.6p1
- bump version to 10.6p1 (for details see [1])

[1] https://www.openssh.org/txt/release-10.6

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f51bf05d24)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 13:20:52 +02:00
Thomas Perale
6f10f81737 package/wolfssl: security bump to v5.9.4
See the release note:

- https://github.com/wolfSSL/wolfssl/releases/tag/v5.9.4-stable

This fixes the following vulnerabilities:

- CVE-2026-15442: https://www.cve.org/CVERecord?id=CVE-2026-15442
- CVE-2026-89102: https://www.cve.org/CVERecord?id=CVE-2026-89102
- CVE-2026-89133: https://www.cve.org/CVERecord?id=CVE-2026-89133
- CVE-2026-89134: https://www.cve.org/CVERecord?id=CVE-2026-89134
- CVE-2026-89135: https://www.cve.org/CVERecord?id=CVE-2026-89135
- CVE-2026-89136: https://www.cve.org/CVERecord?id=CVE-2026-89136
- CVE-2026-93302: https://www.cve.org/CVERecord?id=CVE-2026-93302
- CVE-2026-93304: https://www.cve.org/CVERecord?id=CVE-2026-93304
- CVE-2026-94417: https://www.cve.org/CVERecord?id=CVE-2026-94417
- CVE-2026-94418: https://www.cve.org/CVERecord?id=CVE-2026-94418
- CVE-2026-94419: https://www.cve.org/CVERecord?id=CVE-2026-94419

This commit also updates the LICENSING hash, after an exception
was added in upstream commit:
94c657013d

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
[Julien: fix LICENSING hash]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 7de1ed7745)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 13:20:50 +02:00
Titouan Christophe
c4edb8a805 package/redis: security bump to v8.10.2
See the release notes:
https://github.com/redis/redis/blob/8.10.2/00-RELEASENOTES

No CVE number are mentioned in these notes, however it states:
"Update urgency: `SECURITY`: There are security fixes in the release"

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 5263a5f220)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 13:20:47 +02:00
Yann E. MORIN
23a89f0245 package/gpsd: backport security fixes for CVE-2026-58459
Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Cc: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 8cfad4f0f4)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 13:20:44 +02:00
Bernd Kuhls
e1f54e6c73 package/python3: remove 2to3
Upstream release 3.13.0 first included commit
ae00b810d1
which removed the 2to3 program and the lib2to3 module.

Buildroot commit d63e207eb8 bumped the
package from 3.12.9 to 3.13.2 but forgot to remove its handling.

Current versions of Kodi do not need lib2to3.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: fix typo in commit log version "3.13.9" -> "3.12.9"]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 96bac75585)
[raphael: resolve conflicts in Config.in.legacy]
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 13:20:11 +02:00
Bernd Kuhls
cd1b2818a8 package/python3: remove configure option --without-cxx-main
Upstream release 3.12.0 first included commit
398ed84dc4
which removed the configure option --with-cxx-main.

Buildroot commit 36e635d2d5 bumped the
package from 3.11.6 to 3.12.1 but forgot to remove that configure
option.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 261aaa6d63)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 13:17:46 +02:00
Yegor Yefremov
08c78948dd package/mbedtls: security bump to v3.6.7
For more information about the release, see:

- https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-3.6.7
- https://github.com/Mbed-TLS/mbedtls/compare/mbedtls-3.6.6..mbedtls-3.6.7

Fixes the following vulnerabilities:

- CVE-2026-50587:
    Timing side-channel in RSA PKCS#1 v1.5 decryption

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-50587
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-rsa-pkcs1-v15-decryption-timing-side-channel/

- CVE-2026-50581:
    Extended master secret calculation failure ignored

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-50581
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-extended-master-secret-calculation-failure-ignored/

- CVE-2026-50640:
    Ignored TLS 1.3 resumption secret derivation error

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-50640
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-ignored-tls13-resumption-secret-derivation-error/

- CVE-2026-50713:
    Heap corruption with early renegotiation after corrupted record
    in DTLS

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-50713
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-heap-corruption-early-renegotiation-corrupted-dtls-record/

- CVE-2026-50584:
    ChaCha20 counter overflow can reuse keystream

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-50584
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-chacha20-counter-overflow-keystream-reuse/

- CVE-2026-73096:
    TLS 1.3 early data integrity failure due to buffered plaintext
    across key change

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-73096
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-tls13-early-data-integrity-failure-key-change/

- CVE-2026-35336:
    Possible buffer overflow in mbedtls_ecdh_calc_secret()

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-35336
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-possible-buffer-overflow-ecdh-calc-secret/

- CVE-2026-50580:
    Remote buffer overflow in TLS 1.2 ECDHE-PSK client handshake

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-50580
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-tls12-ecdhe-psk-client-buffer-overflow/

- CVE-2026-54435:
    Side channel leak in ECC optimized modp

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-54435
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-ecc-optimized-modp-side-channel/

- CVE-2026-50586:
    Information disclosure in TLS 1.2 NewSessionTicket

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-50586
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-tls12-newsessionticket-information-disclosure/

- CVE-2026-50583:
    Out-of-bounds read when parsing a zero-length ECC public key

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-50583
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-zero-length-ecc-public-key-oob-read/

- CVE-2026-50588:
    Out-of-bounds read in TLS 1.2 EC J-PAKE ServerKeyExchange
    parsing

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-50588
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-tls12-ecjpake-serverkeyexchange-oob-read/

- CVE-2026-50579:
    Use-after-free in mbedtls_pkcs7_free() when reusing a PKCS7
    context

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-50579
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-use-after-free-pkcs7-free-reused-context/

- CVE-2026-54441:
    Signature algorithm restrictions not enforced on certificate
    chain

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-54441
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-signature-algorithm-restrictions-certificate-chain/

- CVE-2026-50585:
    Incomplete context reset in mbedtls_ssl_session_reset()

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-50585
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-ssl-session-reset-incomplete-context-reset/

- CVE-2026-73064:
    A random generator fault can compromise TLS data integrity

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-73064
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-random-generator-fault-tls-integrity/

- CVE-2026-25832:
    TLS 1.3 client accepts HelloRetryRequest selecting an
    unadvertised group

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-25832
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-tls13-hrr-unadvertised-group/

- CVE-2026-49300:
    X.509 CA bit forgery via invalid basicConstraints extension

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-49300
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-x509-ca-bit-forgery-invalid-basicconstraints/

It also fixes the following issue, which has no CVE identifier:

- PKCS7 signed data verification accepts weak hash algorithms

For more information, see:
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-pkcs7-weak-hash-algorithms-accepted/

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Assisted-by: Claude:claude-opus-5
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 45903c02e3)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 13:17:42 +02:00
Thomas Petazzoni
e2071312ca package/libarchive: drop dependency on host-pkgconf
Commit 95db5707df bumped libarchive to
version 3.8.1, and as part of this, dropped AUTORECONF = YES. This
allowed to drop the host-pkgconf dependency, which was only needed due
to AUTORECONF = YES. However, the host-pkgconf dependency removal was
only done for the target variant of libarchive, and not for the host
variant.

This commit aligns the host variant with the target variant from that
perspective.

This is not tagged as a fix, as nothing was broken.

Cc: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit ddaa55ead5)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 13:17:38 +02:00
Bernd Kuhls
78a14e155a package/vlc: security bump to version 3.0.24
https://code.videolan.org/videolan/vlc/-/blob/3.0.24/NEWS
https://code.videolan.org/videolan/vlc/-/tags/3.0.24

https://www.videolan.org/vlc/releases/3.0.24.html
"Over 130 security fixes across VLC and its bundled libraries"

https://www.videolan.org/security/sb-vlc3024.html
"VLC 3.0.24 fixes over 50 security issues in VLC itself."

Upstream removed unmaintainted libschroediner library:
614914f7bb

Upstream removed support for mfx, which was disabled in buildroot, and
replaced it with optional support for libvpl:
dcd1e9f447

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit cdddb871d3)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 13:17:35 +02:00
Bernd Kuhls
030dc6e253 package/tzdata: bump version to 2026e
https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/VXIA4AU73OQL3OZ3ZBZHWIASIIVBGUJV/
https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/L4IGHJRBUQR53F7RTEHM5IS7ZMBR3YXP/
https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/NVHSX2PAQIT44U5FCCEVNJJYXQMMTJSA/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 3b3f1d6d9d)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 13:17:31 +02:00
Bernd Kuhls
dc7e2cca5c package/hwdata: bump version to 0.412
https://github.com/vcrhonek/hwdata/releases/tag/v0.412

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 57ed2d0d68)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 13:17:27 +02:00