Compare commits

..

226 Commits

Author SHA1 Message Date
Arnout Vandecappelle
71d1dddae1 Makefile: Update for 2026.02.2
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2026-05-20 14:02:52 +02:00
Arnout Vandecappelle
9bf4d998d8 CHANGES: Update for 2026.02.2
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2026-05-20 12:01:57 +02:00
Titouan Christophe
d1d3cf26d2 {linux, linux-headers}: bump 6.12.x, 6.6.x, 6.1.x, 5.15.x, 5.10.x, 6.18.x series
Update the latest kernel releases to:
 - 6.12.84 -> 6.12.90
 - 6.6.136 -> 6.6.140
 - 6.1.169 -> 6.1.173
 - 5.15.203 -> 5.15.207
 - 5.10.253 -> 5.10.256
 - 6.18.25 -> 6.18.32

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2026-05-18 14:18:59 +02:00
Peter Korsgaard
f204a67337 package/go-bootstrap-stage5: security bump to version 1.25.10
Fixes the following security issues:

CVE-2026-33811: net: crash when handling long CNAME response
CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad
                SETTINGS_MAX_FRAME_SIZE
CVE-2026-39817: cmd/go: "go tool pack" does not sanitize output paths
CVE-2026-39819: md/go: "go bug" follows symlinks in predictable temporary
                filenames
CVE-2026-39820: net/mail: quadratic string concatenation in consumeComment
CVE-2026-39823: html/template: bypass of meta content URL escaping causes
                XSS
CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries with more
                than urlmaxqueryparams parameters
CVE-2026-39826: html/template: escaper bypass leads to XSS
CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL byte on
                Windows
CVE-2026-42499: net/mail: quadratic string concatenation in consumePhrase
CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database

go1.25.10 (released 2026-05-07) includes security fixes to the go command,
the pack tool, and the html/template, net, net/http, net/http/httputil,
net/mail, and syscall packages, as well as bug fixes to the go command, the
compiler, the linker, the runtime, and the crypto/fips140, go/types, and os
packages.

https://go.dev/doc/devel/release#go1.25.10

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Reviewed-by: Christian Stewart <christian@aperture.us>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit c19e6d80fb)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:52:42 +02:00
Peter Korsgaard
e876211a23 package/go: security bump to version 1.26.3
Fixes the following security issues:

CVE-2026-33811: net: crash when handling long CNAME response
CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad
                SETTINGS_MAX_FRAME_SIZE
CVE-2026-39817: cmd/go: "go tool pack" does not sanitize output paths
CVE-2026-39819: md/go: "go bug" follows symlinks in predictable temporary
                filenames
CVE-2026-39820: net/mail: quadratic string concatenation in consumeComment
CVE-2026-39823: html/template: bypass of meta content URL escaping causes
                XSS
CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries with more
                than urlmaxqueryparams parameters
CVE-2026-39826: html/template: escaper bypass leads to XSS
CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL byte on
                Windows
CVE-2026-42499: net/mail: quadratic string concatenation in consumePhrase
CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database

go1.26.3 (released 2026-05-07) includes security fixes to the go command,
the pack tool, and the html/template, net, net/http, net/http/httputil,
net/mail, and syscall packages, as well as bug fixes to the go command, the
go fix command, the compiler, the linker, the runtime, and the
crypto/fips140, crypto/tls, go/types, and os packages.

https://go.dev/doc/devel/release#go1.26.3

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit c465f0d8eb)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:52:37 +02:00
Bernd Kuhls
c023dc644a package/php: security bump version to 8.5.6
https://www.php.net/ChangeLog-8.php#8.5.6
https://news-web.php.net/php.announce/492
https://github.com/php/php-src/blob/php-8.5.6/NEWS

Fixes CVE-2026-7263, CVE-2026-6735, CVE-2026-29078, CVE-2026-29079,
CVE-2026-7259, CVE-2026-6104, CVE-2025-14179, CVE-2026-6722,
CVE-2026-7261, CVE-2026-7262, CVE-2026-7568, CVE-2026-7258 &
CVE-2026-42371.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 952aa90078)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:50:06 +02:00
Adrian Perez de Castro
7e18e31220 package/bubblewrap: security bump to version 0.11.2
Fixes CVE-2026-41163, which affects any system using bubblewrap 0.11.x
using a setuid bubblewrap.

Release notes:

  https://github.com/containers/bubblewrap/releases/tag/v0.11.2

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 108f51c1b3)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:50:01 +02:00
Adrian Perez de Castro
f072a76ef4 package/bubblewrap: bump version to 0.11.1
Release notes:

  https://github.com/containers/bubblewrap/releases/tag/v0.11.1

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit ead0c6b182)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:48:38 +02:00
Bernd Kuhls
cf87728c01 package/tor: security bump version to 0.4.9.8
Version 0.4.9.7 fixes the following security bugs:
https://gitlab.torproject.org/tpo/core/tor/-/blob/tor-0.4.9.7/ReleaseNotes

Fixes TROVE-2026-011, TROVE-2026-010, TROVE-2026-009, TROVE-2026-008,
TROVE-2026-007, TROVE-2026-006:
https://gitlab.torproject.org/tpo/core/team/-/wikis/NetworkTeam/TROVE

Version 0.4.9.8 fixes a bug introduced by the bump to 0.4.9.7:
https://gitlab.torproject.org/tpo/core/tor/-/blob/tor-0.4.9.8/ReleaseNotes

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 15fbc52884)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:47:10 +02:00
Bernd Kuhls
3663999399 package/wireless-regdb: bump version to 2026.03.18
https://lists.infradead.org/pipermail/wireless-regdb/2026-March/001844.html

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 3db2f0b33c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:47:01 +02:00
Peter Korsgaard
9989e25158 package/xlib_libXpm: security bump to version 3.5.19
Fixes the following vulnerability:

CVE-2026-4367: libXpm Out-of-bounds read in xpmNextWord()

libXpm uses a number of internal helper functions to parse the XPM file
format.
One of these internal functions, xpmNextString(), checks for the NULL
terminator when looking for the end of the current string but not when
looking for the beginning of the next string.
A small XPM file with a malformed color table definition may cause the
function xpmNextWord(), called from xpmParseColors() following a call to
xpmNextString(), to start past the actual end of the file, causing an
out-of-bound read.

Advisory:
https://lists.x.org/archives/xorg-announce/2026-April/003690.html

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 3aa75c99c1)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:45:49 +02:00
Marcus Hoffmann
d2e399c674 package/gcc: fix gcc-13 build with host gcc 16
Backport 2 patches from upstream maintenance branch. Same fixes as
required for gcc-14.

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 10ccbe079c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:45:40 +02:00
Marcus Hoffmann
2171dafd28 package/gcc: fix gcc-14 build with host gcc 16
Backport two patches from upstream gcc-14 maintenance branch. Requires
one more patch on top of the fix for gcc-15.

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit dee4991cd1)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:45:33 +02:00
Marcus Hoffmann
ae07c3c72b package/gcc: fix gcc-15 build with host gcc 16
Backport patch that was applied upstream to the gcc-15 maintenance
branch.

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 0dd4196fa0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:45:24 +02:00
Marcus Hoffmann
742c874f67 package/python-django: security bump to 6.0.5
Django 6.0.5 fixes three security issues with severity “low” and several bugs in 6.0.4.

Security Fixes:
* CVE-2026-5766: Potential denial-of-service vulnerability in ASGI
    requests via file upload limit bypass ASGI requests with a missing
    or understated Content-Length header could bypass the
    FILE_UPLOAD_MAX_MEMORY_SIZE limit, potentially loading large files into
    memory and causing service degradation.

    As a reminder, Django expects a limit to be configured at the web server
    level rather than solely relying on FILE_UPLOAD_MAX_MEMORY_SIZE.

    This issue has severity “low” according to the Django security policy

* CVE-2026-35192: Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST
    Response headers did not vary on cookies if a session was not modified,
    but SESSION_SAVE_EVERY_REQUEST was True. A remote attacker could steal a
    user’s session after that user visits a cached public page.

    This issue has severity “low” according to the Django security policy.

* CVE-2026-6907: Potential exposure of private data due to incorrect
    handling of Vary: * in UpdateCacheMiddleware

    Previously, UpdateCacheMiddleware would erroneously cache requests where
    the Vary header contained an asterisk ('*'). This could lead to private
    data being stored and served.

    This issue has severity “low” according to the Django security policy.

Bugfixes:
* Fixed a misplaced </div> in the
  django/contrib/admin/templates/admin/change_list.html template added
  in Django 6.0 that could be problematic when overriding the pagination
  block (#37029).
* Fixed a bug in Django 6.0 where deprecation warnings incorrectly
  skipped lines from third-party packages prefixed with “django”
  (#37067).

Release notes: https://docs.djangoproject.com/en/6.0/releases/6.0.5/

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 4fe009b6aa)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:44:56 +02:00
Alexis Lothoré
440738e291 package/frr: install systemd service files
The FRR package currently only installs systemv services files. The
upstream package also provides a systemd service file and a service
template file. Install those when systemd is selected as an init
manager.

Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit 5af981a672)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:25:56 +02:00
Giulio Benetti
6e4668c060 package/ffmpeg: securty bump version to 6.1.5
Fixes: CVE-2026-30997 - FFmpeg AV1 Decoding Out-of-Bounds Read Vulnerability [1]

Full changelog: https://code.ffmpeg.org/FFmpeg/FFmpeg/src/tag/n6.1.5/Changelog

License file hash changed due to removing U+000C unicode characters in [2].

[1] a44ab44236
[2] 735acddb8a

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
[Marcus: mention security fix, use upstream url for changelog instead of videolan mirror]
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit 6cd936b8e7)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:24:03 +02:00
Giulio Benetti
e1b39a1fd3 package/p7zip: security bump to version v17.06
What's Changed:
  - Fix CVE-2021-3520 affected components Lz4 1.9.3 in p7zip17 (#239)

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>a
[Marcus: mark as security bump]
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit 760e16dcc0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:22:43 +02:00
Fiona Klute
cb4e02c6ac support/scripts/pkg-stats: run main function only if called as script
The __name__ == '__main__' guard allows importing pkg-stats as a
module using importlib, circumventing the normal module filename
requirements. This in turn makes it possible to test/debug individual
functions.

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 8cde69e101)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:22:33 +02:00
Fiona Klute
071ba58f00 support/scripts/pkg-stats: don't buffer whole file searching for infra
The file handle can be iterated over directly and each line is used
exactly once, so the only effect of reading all lines into a list
first was higher memory use and complexity.

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 07f7ad9898)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:22:25 +02:00
Fiona Klute
34204529e0 support/scripts/pkg-stats: fix host/target infra filter
The filter is supposed to exclude host/target infra from output if the
respective package is not built with the current
configuration.

However, excluding host packages did not work correctly: If keep_host
is False because the host package is not built, the next branch was
checked and included the host infra in output with "target" type if
the target package is built. For a package that support host and
target build, but gets built only for the target, this leads to output
like (Meson example):

meson (target)
host-meson (target)

Skip host infra in the target branch instead. Also include
Package.infra in Package.__str__() result, which was needed for
debugging this bug.

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit e8dcebf459)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:22:14 +02:00
Fiona Klute
6ea66ebd69 linux/Config.in: add kernel.org URL to help
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
[Arnout: add it to the main help text, where it belongs]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 2ab95cf0ee)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:21:58 +02:00
Fiona Klute
056588171d support/scripts/pkg-stats: format upstream URL info consistently in HTML
Use only one of the classes for "error" or "warning" status so they
look different, and format the error/warning text for both. Do not
make the text a link if the URL is None.

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 7961bd10b9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:21:43 +02:00
Fiona Klute
54a7730033 support/scripts/pkg-stats: search only Config.in{, .host} for URL
The previous Config.* glob also caught linux/Config.ext.in and
package/php/Config.ext, as well as some backup files created by
editors (e.g. Config.in~ after editing a Config.in file in Emacs),
leading to wrong results depending on directory listing order.

Also use "with" to automatically close the file when the block is
left, even on error.

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 77a464969c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:21:12 +02:00
Martin Kepplinger-Novaković
9a29752770 DEVELOPERS: remove Martin Kepplinger from x11vnc
I don't use maintain x11vnc in buildroot anymore and can't easily test.

Signed-off-by: Martin Kepplinger-Novaković <martink@posteo.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 81e72115a0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:20:39 +02:00
Fiona Klute
699d4cfd7f package/eudev: fix install with BR2_ROOTFS_MERGED_BIN=y
Eudev install creates a symlink from $(sbindir)/udevadm to
$(bindir)/udevadm if sbindir and bindir are different [1].
Unfortunately the check considers only the configured values as
strings and does not resolve symlinks. This means that in a merged-bin
setup with sbindir=/sbin (symlink to /usr/sbin, which is a symlink to
/usr/bin) and bindir=/usr/bin the /usr/bin/udevadm binary gets
overwritten with a link to itself.

Set sbindir according to the merge setup to avoid the problem, bindir
defaults to /usr/bin in any case.

[1] 9e7c4e744b/src/udev/Makefile.am (L139-L140)

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit a063c89dc2)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:20:22 +02:00
Fiona Klute
0d8372b7e0 package/watchdogd/S01watchdogd: immediately return if sending stop fails
If sending the stop signal fails but the PID file exists the following
shutdown wait turns into an endless loop. Avoid that and return the
error immediately.

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit 6558eb3d65)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:20:15 +02:00
Fiona Klute
c272ee972b package/openssh/S50sshd: immediately return if sending stop fails
If sending the stop signal fails but the PID file exists the following
shutdown wait turns into an endless loop. Avoid that and return the
error immediately.

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit 34f4732f1a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:19:52 +02:00
Daniel Houck
dd1ddca614 package/make: fix build with musl and gcc-15.x
Patch the parts of Make that use code invalid in C23.  It wasn't
included when compiling with glibc but failed to build with musl.

Fixes #176.  See also https://savannah.gnu.org/bugs/index.php?68302

Signed-off-by: Daniel Houck <Software@DRHouck.me>
[Marcus: link to savannah bug report also in the patchfile]
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit dff61f65ec)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:19:28 +02:00
Fiona Klute
c7e20789e8 package/openssh: explicitly configure PID file directory
OpenSSH checks during ./configure if the default location /var/run
exists on the build host, and defaults to ${sysconfdir} (/etc/ssh in
Buildroot) if not. This can break e.g. in a sandbox with its own mount
namespace where there is no reason to create a /var.

On the target this leads to errors when starting/stopping the service
from the init script, which expects the PID file at /var/run/sshd.pid if
sshd is running. A "stop" (including as part of "restart") or "reload"
will always fail with

    no /usr/sbin/sshd found; none killed

from start-stop-daemon, even though sshd is running (because the PID
file doesn't exist where start-stop-daemon tries to read it).

On the other hand, a "start" command will try to start sshd even if it
is already running, because it cannot detect the running instance.
Unfortunately sshd does not fail directly in that situation (so the init
script completes), but something like the following appears in the log:

    [May 04 14:48:05] auth sshd[4592]: error: Bind to port 22 on 0.0.0.0
    failed: Address in use.
    [May 04 14:48:05] auth sshd[4592]: error: Bind to port 22 on :: failed:
    Address in use.
    [May 04 14:48:05] auth sshd[4592]: fatal: Cannot bind any address.

Explicitly setting --with-pid-dir=/var/run overrides either default,
and only logs a warning if /var/run does not exist.

[1] 5fa60ae0d2/configure.ac (L5568-L5576)

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
[Marcus: expand commit message after discussion on ML]
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit c09bec68f1)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:18:15 +02:00
Bernd Kuhls
ce4d425a53 package/apache: security bump version to 2.4.67
Changelog:
https://downloads.apache.org/httpd/CHANGES_2.4.67

Fixes CVE-2026-23918, CVE-2026-24072, CVE-2026-28780, CVE-2026-29168,
CVE-2026-29169, CVE-2026-33006, CVE-2026-33007, CVE-2026-33523,
CVE-2026-33857, CVE-2026-34032 & CVE-2026-34059.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit a52df2cc85)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:17:39 +02:00
Peter Korsgaard
07f84877f5 package/mutt: bump version to 2.2.16
Bugfix release fixing crash / NULL pointer access issues and gsasl
authentication compatibility with Microsoft servers.

Mutt 2.2.14 was released on February 20, 2025.  This is a bug-fix release,
fixing a couple possible crashes, in GPGME and with IMAP when logging out,
and correcting a small issue with unnecessary encoding of "." in attachment
names (2231 encoding).

Mutt 2.2.15 was released on October 2, 2025.  This is a bug-fix release,
fixing an IMAP search/limit bug, a compilation issue, and containing a
workaround for gsasl SMTP authentication issues with some MS servers.  A few
parts of the documentation were also improved.

Mutt 2.2.16 was released on November 22, 2025.  This is a bug-fix release,
fixing a resource leak when compiled with OpenSSL/LibreSSL, which could
eventually result in new connections failing.

http://www.mutt.org/news.html

The 2.2.16 release is not available on bitbucket, so change to the official
ftp.mutt.org location instead.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 206cd3cd31)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:17:11 +02:00
Peter Korsgaard
2748583c04 package/haproxy: bump version to 6.2.27
Bugfix release with large number of (security) fixes.

For 6.2.26:

- a severe issue was found in the compression library (slz) where
    specially crafted patterns with tune.bufsize above 17408 or
    tune.maxrewrite below 964 (both non-default) could cause output
    buffer overflows due to the overhead exceeding the promised
    worst-case growth bound of 5 bytes and reach up to 1/16 of the
    input contents. Given that the compression output is hardly
    controllable, and the canaries at the end of the pools will catch
    this at release time, the risk of exploitation by a hostile server
    is close to zero, however it will cause repeated crashes if such a
    crafted file is present on a server and regularly downloaded. A
    workaround consists in keeping tune.maxrewrite at least 1/16 of
    tune.bufsize or just not changing them since the defaults are safe.
    A CVE was requested two weeks ago for this one, I'll mention it when
    it arrives.

  - HTTP/2 incomplete transfer detection was missing for HEADERS frames
    carrying END_STREAM. When relayed to an HTTP/1.1 server that
    responds before the end of the transfer, this can result in bytes
    of the next request over the same connection to be ignored. Most of
    the time it will cause the connection to be dropped due to an
    unparsable request, but when combined with "http-reuse never", or
    on totally idle servers, the client could expect the second request
    to reuse the same connection and perform a content smuggling attack
    that would allow to pass an unverified request to a server. For
    those who can't upgrade, a temporary workaround is to disable
    HTTP/2 by specifying "alpn http/1.1" on bind lines and adding
    "disable-h2-upgrade" in HTTP frontends. A CVE will be requested for
    this one.

  - HTTP/1.1 bodyless messages announcing a non-null Content-Length did
    not force close mode on the backend, potentially causing
    desynchronisation between HAProxy and the server in conjunction
    with other bugs.

  - FCGI record length truncation with large bufsize (>=65544) could
    enable request smuggling into PHP-FPM since the 16-bit
    content_length field silently truncated to 65535 bytes.

  - an unvalidated SNI name_len field in ClientHello could cause OOB
    heap reads of up to 65KB via XXH3, smp_dup(), and log-format leaks
    on any TCP frontend using req.ssl_sni, possibly causing crashes when
    used.

  - ECDSA JWT signatures with ES256/384/512 could cause a heap overflow
    of ~14 bytes in the DER conversion before verification.

  - Lua's httpclient headers conversion accepted more than 101 headers
    without bound checking, causing a stack buffer overflow reachable
    from any Lua action/task/service.

  - peers dictionary cache updates accepted an unvalidated entry id as
    array index, allowing OOB heap writes at attacker-controlled
    offsets.

  - Lua had a use-after-free of HTTP reason strings managed by Lua's GC
    between set_status() and start_response(), potentially leaking
    adjacent information from memory.

  - the regsub sample function could leak ~9-50KB of stale heap data
    when back-reference expansion overflowed the output buffer.

  - SPOE decode_varint() had no iteration cap, allowing pointer
    arithmetic to wrap and dereference memory ~64KB before the
    allocation, causing SIGSEGV or parser confusion.

  - in sample expressions, less common HTTP methods (PATCH etc.) are
    represented by both an enum and a string. The string part was not
    handled correctly in sample duplication functions, resulting in
    their contents appearing empty when trying to fetch the method.

  - QPACK varint decoding is now also limited to 62-bit, and had a risk
    of 1-byte OOB reads on truncated streams, which could cause
    incorrect header decoding.

  - config: a few argument parsing errors in conditional expressions
    used in ".if" could be misreported and even cause a crash during
    the parsing. Also, a few keywords relying on warnif_misplaced_*
    didn't check the return value and didn't count emitted warnings as
    warnings.

For more details, see the announcement:
https://www.mail-archive.com/haproxy@formilux.org/msg47016.html

For 6.2.27:

A major issue were fixed by this release. It was related to the scheme-based
normalization. The presence of commas in Host header and authority was permitted
and would be used to compare the values, which then would differ when read via
hdr(host) which splits them on commas, and under certain circumstances, trigger
crashes (at least it did in the OSS-Fuzz environment when injecting the values
directly at the HTX layer). The issue was fixed.  Remains the case of the comma
characters in authorities. Even though the spec permits commas in authorities
(not in domain names), there is currently no use case for this and it causes an
ambiguity with the historical use of hdr(host), so we preferred to just deny
them. The change was performed on the 3.4-dev10 and postponed for the next 3.3
release. It will probably be backported to lower versions too.

An issue in the FCGI multiplexer was fixed. The function responsible to emit
FCGI_PARAM records was not handling cases of full buffer in a consistent
way. The issue was quite limited, but the "http-send-name-header" option could
be silently ignored. The issue was fixed by reworking this function.

The scheme-based normalization was fixed to properly handle case of OPTIONS
requests. As stated in RFC9110#4.2.3, when the scheme-based normalization is
performed, an empty path must be normalized to "/", except for OPTIONS request.

Finally, a memory leak on error path (tools) and other minor issues were also
fixed.

For more details, see the announcement:
https://www.mail-archive.com/haproxy@formilux.org/msg47059.html

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 22f1e90d6b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:16:31 +02:00
Bernd Kuhls
5b6a0d9c6b package/haproxy: bump version to 2.6.25
http://www.haproxy.org/download/2.6/src/CHANGELOG

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 85f1e9cf0b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:16:22 +02:00
Bernd Kuhls
4d173cc6e3 package/python-pyopenssl: security bump version to 26.1.0
https://github.com/pyca/pyopenssl/blob/26.1.0/CHANGELOG.rst

Version 26.1.0 fixes CVE-2026-40475
Version 26.0.0 fixes CVE-2026-27459 & CVE-2026-27448.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 7bcba8498b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 15:30:37 +02:00
Bernd Kuhls
2a872f3032 package/libpjsip: security bump version to 2.17
https://github.com/pjsip/pjproject/releases/tag/2.17

Fixes the following CVEs:

CVE-2026-25994, CVE-2026-26203, CVE-2026-26967, CVE-2026-29068,
CVE-2026-28799, CVE-2026-32942, CVE-2026-32945, CVE-2026-33069,
CVE-2026-34235, CVE-2026-40614, CVE-2026-40892, CVE-2026-41416,
CVE-2026-41415, CVE-2026-42225.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit e1f77168d1)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 14:27:17 +02:00
Bernd Kuhls
9da6e86831 package/libpjsip: enable parallel builds
Parallel builds were disabled in 2016 by buildroot commit
781ce19d74.

In 2020 upstream added two commits which fix parallel builds
ddf48e2045
78683646c8
to version 2.11 which was added to buildroot with commit
2c7ad667ec.

Tested with -j100.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit 3ddeb7a9d3)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 13:59:31 +02:00
Shubham Chakraborty
44336bb9a7 package/nginx: security bump to version 1.28.3
Fixes the following security issues:
- CVE-2026-27654: Buffer overflow in ngx_http_dav_module when using the
  alias directive with WebDAV COPY or MOVE requests.
- CVE-2026-27784 & CVE-2026-32647: Buffer overflows in ngx_http_mp4_module
  when processing specially crafted MP4 files.
- CVE-2026-27651: NULL pointer dereference in the mail proxy module
  during CRAM-MD5 or APOP authentication retries.
- CVE-2026-28753: DNS PTR record manipulation in auth_http or SMTP proxy.
- CVE-2026-28755: OCSP certificate check bypass in the stream module.

For a full list of changes, see:
https://nginx.org/en/CHANGES-1.28

Signed-off-by: Shubham Chakraborty <chakrabortyshubham66@gmail.com>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit 8008da299f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 13:59:29 +02:00
Bernd Kuhls
68b0084932 package/netsnmp: enable parallel build
Buildroot commit 7643670052 disabled
parallel builds in 2012.

Upstream fixed the problem in 2021:
855e1c28da
9ea3d8b93c
with version 5.9.1 which was added to buildroot with commit
83b4337354.

Tested with -j100.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit ae4c2baab9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-13 14:53:36 +02:00
Shubham Chakraborty
4ed87fcf74 DEVELOPERS: add Shubham Chakraborty as dos2unix maintainer
Add entry for package/dos2unix/

Signed-off-by: Shubham Chakraborty <chakrabortyshubham66@gmail.com>
[Julien: reword commit title]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 9f3097bcf6)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-13 14:53:22 +02:00
Bernd Kuhls
9dbdc05a97 package/libsodium: security bump version to 1.0.22
https://github.com/jedisct1/libsodium/releases/tag/1.0.22-RELEASE
https://github.com/jedisct1/libsodium/releases/tag/1.0.21-RELEASE

Updated license hash due to copyright year bump:
80c6bab451

Switched to bz2 tarball provided by upstream.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d4d46b275c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-13 14:50:48 +02:00
Thomas Perale
3db14ab765 package/dropbear: patch CVE-2019-6111 CVE-2026-35385
While CVE-2019-6111 was already fixed in 2025.89, the version 2026.90
provided a follow up of that fix.

Note that the author provided this note with this patch:

> Note breaking change: "-r" is now disallowed when the target directory exists
> (an additional change in Dropbear's version). If that's required an alternative
> such as rsync could be used.

Adapt your usage of dropbear accordingly.

- CVE-2019-6111:
    An issue was discovered in OpenSSH 7.9. Due to the scp implementation
    being derived from 1983 rcp, the server chooses which
    files/directories are sent to the client. However, the scp client only
    performs cursory validation of the object name returned (only
    directory traversal attacks are prevented). A malicious scp server (or
    Man-in-The-Middle attacker) can overwrite arbitrary files in the scp
    client target directory. If recursive operation (-r) is performed, the
    server can manipulate subdirectories as well (for example, to
    overwrite the .ssh/authorized_keys file).

For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2019-6111

- CVE-2026-35385:
    In OpenSSH before 10.3, a file downloaded by scp may be installed
    setuid or setgid, an outcome contrary to some users' expectations, if
    the download is performed as root with -O (legacy scp protocol) and
    without -p (preserve mode).

For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2026-35385

[1] https://github.com/mkj/dropbear/releases/tag/DROPBEAR_2026.90

(cherry picked from commit 5b136c89ff)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-13 14:49:54 +02:00
Bernd Kuhls
c8321c0500 package/python-requests: security bump version to 2.33.1
https://github.com/psf/requests/releases/tag/v2.33.1

https://github.com/psf/requests/releases/tag/v2.33.0
Fixes CVE-2026-25645.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit b595f48fd9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-13 14:47:59 +02:00
Bernd Kuhls
f7794333cb package/python-pyasn1: security bump version to 0.6.3
https://github.com/pyasn1/pyasn1/blob/v0.6.3/CHANGES.rst

Fixes CVE-2026-30922.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 123136b246)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-13 14:37:39 +02:00
Bernd Kuhls
5b4194680c package/python-lmdb: security bump version to 2.2.0
https://github.com/jnwatson/py-lmdb/blob/py-lmdb_2.2.0/ChangeLog

Version 2.1.0 fixes the following CVEs:

- **CVE-2019-16224**: heap buffer overflow via `MDB_DUPFIXED` without
    `MDB_DUPSORT` in on-disk `md_flags`. (#429)

- **CVE-2019-16225**: `SIGSEGV` from `P_DIRTY` flag set on mmap'd disk pages,
    causing `mdb_page_touch()` to skip copy-on-write. (#429)

- **CVE-2019-16226**: out-of-bounds `memmove` in `mdb_node_del` via corrupt
    `mn_hi` making `NODEDSZ()` huge. (#429)

- **CVE-2019-16227**: NULL pointer dereference of `mc_xcursor` when
    `F_DUPDATA` is set on a node in a non-DUPSORT database. (#429)

- **CVE-2019-16228**: divide-by-zero from zero `mm_psize` in meta page
    header. (#429)

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 2286c4a02c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-13 14:36:45 +02:00
Bernd Kuhls
1ac609d83e package/python-lmdb: bump version to 1.8.1
https://github.com/jnwatson/py-lmdb/blob/py-lmdb_1.8.1/ChangeLog

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 6df86418f5)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-13 14:35:26 +02:00
Bernd Kuhls
39098f7d04 package/python-certifi: bump version to 2026.4.22
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 4662c679e7)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-13 13:57:57 +02:00
Bernd Kuhls
ff38ae4cc7 package/python-certifi: bump version to 2026.2.25
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 81541039cd)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-13 13:57:55 +02:00
Bernd Kuhls
e90e6c7aa9 package/python-cbor2: security bump version to 5.9.0
https://github.com/agronholm/cbor2/blob/5.9.0/docs/versionhistory.rst

Fixes CVE-2026-26209.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit b676a4f51b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-13 13:57:53 +02:00
Giulio Benetti
fc08d9c32c DEVELOPERS: add Giulio Benetti to wireshark
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d230af8bba)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-13 13:57:51 +02:00
Giulio Benetti
465f1dced9 package/wireshark: security bump to v4.4.15
For more information on the version bump, see:
  - https://www.wireshark.org/docs/relnotes/wireshark-4.4.15.html

Fixes the following vulnerabilities:
CVE-2026-5409, CVE-2026-5408, CVE-2026-5406, CVE-2026-5407, CVE-2026-5299,
CVE-2026-5401, CVE-2026-5404, CVE-2026-5403, CVE-2026-5405, CVE-2026-5654,
CVE-2026-5657, CVE-2026-5656, CVE-2026-5653, CVE-2026-6538, CVE-2026-6537,
CVE-2026-6535, CVE-2026-6534, CVE-2026-6533, CVE-2026-6532, CVE-2026-6531,
CVE-2026-6530, CVE-2026-6529, CVE-2026-6527, CVE-2026-6524, CVE-2026-6523,
CVE-2026-6521, CVE-2026-6520, CVE-2026-6519, CVE-2026-6522, CVE-2026-6870,
CVE-2026-6869, CVE-2026-6868.

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 1880965a3b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-13 13:57:49 +02:00
Bernd Kuhls
bef8aefcde package/thrift: security bump version to 0.23.0
https://github.com/apache/thrift/blob/v0.23.0/CHANGES.md

Fixes the following CVEs:

CVE-2026-41636: https://seclists.org/oss-sec/2026/q2/236
CVE-2026-41607: https://seclists.org/oss-sec/2026/q2/237
CVE-2026-41606: https://seclists.org/oss-sec/2026/q2/238
CVE-2026-41605: https://seclists.org/oss-sec/2026/q2/239
CVE-2026-41604: https://seclists.org/oss-sec/2026/q2/240
CVE-2026-41602: https://seclists.org/oss-sec/2026/q2/241
CVE-2026-41603: https://seclists.org/oss-sec/2026/q2/242
CVE-2025-48431: https://seclists.org/oss-sec/2026/q2/243

This commit also adds "Public Domain" in THRIFT_LICENSE, after
upstream commit [1] added a new sha256 implementation with that
license. The LICENSE file hash is also updated accordingly.

[1] 1e5fa4b9b3

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 6935bc7412)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-13 13:57:47 +02:00
Thomas Perale
770b3996ed package/proftpd: patch CVE-2026-42167
- CVE-2026-42167:
    mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute
    arbitrary code via a username, in scenarios where there is logging of
    USER requests with an expansion such as %U, and the SQL backend allows
    commands (e.g., COPY TO PROGRAM).

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-42167
 - https://github.com/proftpd/proftpd/issues/2052
 - af90843baf

The backport was provided by the Fedora Community:
 - https://src.fedoraproject.org/rpms/proftpd/raw/epel9/f/2052.patch

(cherry picked from commit 0d5ce9ed84)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-13 13:57:44 +02:00
Bernd Kuhls
932a344da1 package/gnutls: security bump to version 3.8.13
https://lists.gnupg.org/pipermail/gnutls-help/2026-April/004922.html

Fixes the following CVEs:

CVE-2026-33845
CVE-2026-33846
CVE-2026-3832
CVE-2026-3833
CVE-2026-42009
CVE-2026-42010
CVE-2026-42011
CVE-2026-42012
CVE-2026-42013
CVE-2026-42014
CVE-2026-42015
CVE-2026-5260
CVE-2026-5419

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d459d257c3)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-12 15:45:51 +02:00
Bernd Kuhls
49091c120f package/libcurl: security bump to version 8.20.0
https://curl.se/ch/8.20.0.html
https://curl.se/docs/security.html

Fixes the following CVEs:
https://curl.se/docs/CVE-2026-7168.html
https://curl.se/docs/CVE-2026-7009.html
https://curl.se/docs/CVE-2026-6429.html
https://curl.se/docs/CVE-2026-6276.html
https://curl.se/docs/CVE-2026-6253.html
https://curl.se/docs/CVE-2026-5773.html
https://curl.se/docs/CVE-2026-5545.html
https://curl.se/docs/CVE-2026-4873.html

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 8940fae607)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-12 15:45:29 +02:00
Bernd Kuhls
5751317898 package/exim: security bump version to 4.99.2
https://lists.exim.org/lurker/message/20260429.121733.f58d9686.en.html

Fixes CVEs:

CVE-2026-40684     Possible crash with malicious DNS data when using musl libc

   On systems using musl libc (not glibc) due to an oddity in octal printing
   it is possible to crash the connection instance when malformed DNS data
   is present in PTR records.

CVE-2026-40685     Possible OOB read/write on corrupt JSON in header

   configurations using json operators on invalid externally-provided input
   could trigger heap corruption.

CVE-2026-40686     Possible OOB read with large UTF8 trailing characters

   configurations using utf8 operators on malformed utf8 in headers could
   trigger OOB reads and might trigger some data leak if error
   messages are required for subsequent emails in the current connection
   and similar malformed headers are present.

CVE-2026-40687     Possible OOB read/write with SPA authenticator

   in configurations using the SPA authentication driver to a hostile/compromised
   external SPA/NTLM connnection it is possible to trigger an OOB read/write
   and crash the connection instance or possibly leak heap data to the instance.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 3f6d37ab9a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-12 15:45:04 +02:00
Bernd Kuhls
ccbf9130c5 package/rsync: security bump version to 3.4.2
https://download.samba.org/pub/rsync/NEWS#3.4.2

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 2f9fff2234)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-12 15:44:39 +02:00
Fiona Klute
aa938fe697 Revert "kmod: workaround for microblaze ld bug"
This reverts commit 0d81107f02. The bug
the workaround is for was fixed in binutils 2.29.51 (first release
listed in bfd/ChangeLog after the fix), which is by now far older than
any version supported by Buildroot.

Compile tested with qemu_microblazeel_mmu_defconfig plus
BR2_PACKAGE_KMOD=y.

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit 7653e616f9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-12 15:42:11 +02:00
Francois Perrad
36bc94ee79 package/libpcap: security bump to version 1.10.6
fix CVE-2025-11961: Fix OOBR and OOBW in pcap_ether_aton()

For change log, see:
https://github.com/the-tcpdump-group/libpcap/blob/libpcap-1.10.6/CHANGES

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 146c8a518d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-12 15:40:53 +02:00
Raphael Pavlidis
62ef552dd4 package/linux-pam: security bump to version 1.7.2
Fixes (in 1.7.1): CVE-2025-6020 - pam_namespace: potential privilege escalation

https://github.com/linux-pam/linux-pam/security/advisories/GHSA-f9p8-gjr4-j9gx

The build system was changed from autotools to meson in 1.7.0.

Changelog:
https://github.com/linux-pam/linux-pam/releases/tag/v1.7.0
https://github.com/linux-pam/linux-pam/releases/tag/v1.7.1
https://github.com/linux-pam/linux-pam/releases/tag/v1.7.2

Signed-off-by: Raphael Pavlidis <raphael.pavlidis@gmail.com>
[Marcus: add note about the CVE fixed in this bump]
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit 30e38505e4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-12 15:33:36 +02:00
Bernd Kuhls
8a2fb50682 package/opensc: security bump version to 0.27.1
https://github.com/OpenSC/OpenSC/blob/0.27.1/NEWS

Switched to sha256 tarball hash provided by upstream.

Removed patch which is included in this release.

Fixes the following CVEs:
* CVE-2025-13763: Several uses of potentially uninitialized memory
                  detected by fuzzers
* CVE-2025-49010: Possible write beyond buffer bounds during processing
                  of GET RESPONSE APDU
* CVE-2025-66215: Possible write beyond buffer bounds in oberthur driver
* CVE-2025-66038: Possible read beyond buffer bounds when parsing
                  historical bytes in PIV driver
* CVE-2025-66037: Possible buffer overrun while parsing SPKI

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit baa0a13653)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-12 15:29:44 +02:00
Eugen Hristev
292e1e65d7 DEVELOPERS: Update email for Eugen Hristev
Replace old bouncing email address.

Signed-off-by: Eugen Hristev <ehristev@kernel.org>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit bd9e30470f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-12 15:28:24 +02:00
Fiona Klute
c5a0a71d7c package/initscripts: fix check-package warnings & indent
No functional change. Add package-level .editorconfig so indentation
matches what other init scripts use.

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 3a488674b5)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-12 15:28:02 +02:00
Peter Korsgaard
593c050f4d package/liburiparser: security bump to version 1.0.1
Fixes the following vulnerability:

CVE-2026-42371: integer overflow in text range comparison
https://github.com/uriparser/uriparser/pull/298

For details, see the announcement:
https://www.openwall.com/lists/oss-security/2026/04/27/2

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit a8e7f79241)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-12 15:21:19 +02:00
Bernd Kuhls
226f163aa0 package/lcms2: security bump version to 2.19
https://littlecms.com/blog/2026/04/17/lcms2-2.19/
https://github.com/mm2/Little-CMS/blob/lcms2.19/ChangeLog

Fixes CVE-2026-41254:
https://security-tracker.debian.org/tracker/CVE-2026-41254

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit c409050184)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-12 15:18:15 +02:00
Fiona Klute
b0efb8c15e package/network-manager: drop obsolete dependency on host-intltool
NetworkManager stopped requiring intltool with 1.40:
56b51b98fb/NEWS (L434)

Fixes: e7c20ad548

host-gettext is already an indirect dependency via package/libglib2.

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
[Marcus: add reference to commit that updated NM to 1.40]
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit c393060c7e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-12 15:13:31 +02:00
Fiona Klute
712e2e8f7c package/python3/Config.in.host: remove select on BR2_PACKAGE_HOST_OPENSSL
There is no such option, and according to the commit history never
was. If BR2_PACKAGE_HOST_PYTHON3_SSL=y the build adds host-openssl to
HOST_PYTHON3_DEPENDENCIES directly.

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit 201d6f4937)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-12 15:11:24 +02:00
Bernd Kuhls
e79faf42b6 package/sudo: bump version to 1.9.17p2
https://github.com/sudo-project/sudo/blob/v1.9.17p2/NEWS

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d96eb2f7da)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 14:11:11 +02:00
Bernd Kuhls
ce727d0f75 package/libpng: bump to version 1.6.58
https://github.com/pnggroup/libpng/blob/v1.6.58/ANNOUNCE
"Fixed a regression introduced in version 1.6.56 [...]"

A backport to LTS branches should be considered.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit bc73ca37ef)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 14:10:54 +02:00
Bernd Kuhls
72be078729 package/libxml2: security bump version to 2.15.3
https://download.gnome.org/sources/libxml2/2.15/libxml2-2.15.3.news

- parser: Pass userData to SAX text callbacks in xmlParseReference (type-confusion)
- entities: copy children in xmlCopyEntity
- c14n: Fix Type confusion in xmlC14NProcessAttrsAxis
- python: Do not decref string after adding to the list (double-free / use-after-free)
- c14n: Reuse tmp_str, xmlStrcat reallocates *cur (double-free)

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit c1a34838b9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 14:10:35 +02:00
Bernd Kuhls
0a6eb13542 package/expat: security bump version to 2.8.0
https://github.com/libexpat/libexpat/blob/R_2_8_0/expat/Changes

Fixes CVE-2026-41080.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit c3dfd775b0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 14:10:18 +02:00
Bernd Kuhls
08cd573f0c package/neon: fix build with zlib
Building this defconfig

BR2_x86_64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_PACKAGE_NEON=y
BR2_PACKAGE_NEON_ZLIB=y

does not build libneon with zlib support, quoting configure log:

  configure: zlib not enabled

although the configure parameter

  --with-zlib=/home/bernd/buildroot/output/host/x86_64-buildroot-linux-gnu/sysroot

was used.

The reason is the addition of "=$(STAGING_DIR)" to --with-zlib which was
added to buildroot in 2008 with commit
cc6562ff83.

The upstream code, which expects only "yes", all other values lead to
the else-condition, is unchanged since 2004:
https://github.com/notroj/neon/blame/0.37.1/macros/neon.m4#L478
so a backport of this patch to LTS branches should be considered.

With this patch the configure log shows:

  checking for zlib.h... yes
  checking for inflate in -lz... yes
  configure: zlib support enabled, using -lz

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 5e917c3a81)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 14:09:44 +02:00
Fiona Klute
295e92b1cb package/ca-certificates: bump to 20260223
Changelog including list of added/removed CAs:
b266ecf6af/debian/changelog

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d7ebed6df0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 14:09:16 +02:00
Bernd Kuhls
d36db25ccc DEVELOPERS: remove Clayton Shotwell, e-mail bounces
<clayton.shotwell@collins.com>: host
    mxb-00105402.gslb.gpphosted.com[67.231.155.145] said: 550 5.1.1 User
    Unknown (in reply to RCPT TO command)

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 6774a1e4c8)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 14:08:58 +02:00
Francois Perrad
1b2573e946 package/ficl: bump to version 3.065
- sources are now hosted on Github
- ficl have its own LICENSE file
- remove one upstreamed patch
- support only static lib
- requires C11

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e7dcf9e5af)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 14:08:49 +02:00
Francois Perrad
9b0cb875ef package/ficl: downgrade to version 3.03
see https://sourceforge.net/p/ficl/news/2025/07/ficl4-is-retiring/

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 20bd902142)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 14:08:28 +02:00
Fiona Klute
f43fdf13c7 package/btrfs-progs: remove unnecessary autoreconf
Commit 1c11f9020a removed the patch
changing configure.ac with the bump to 6.10, so it is no longer
needed.

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 9fd8a1cf49)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 14:08:21 +02:00
Marcus Hoffmann
d97a710167 package/python-django: security bump to 6.0.4
Django 6.0.4 fixes one security issue with severity “moderate”, four
security issues with severity “low”, and several bugs in 6.0.3.

Security issues:
* CVE-2026-3902: ASGI header spoofing via underscore/hyphen conflation
    ASGIRequest normalizes header names following WSGI conventions, mapping
    hyphens to underscores. As a result, even in configurations where
    reverse proxies carefully strip security-sensitive headers named with
    hyphens, such a header could be spoofed by supplying a header named with
    underscores.

    Under WSGI, it is the responsibility of the server or proxy to avoid
    ambiguous mappings. (Django’s runserver was patched in CVE 2015-0219.)
    But under ASGI, there is not the same uniform expectation, even if many
    proxies protect against this under default configuration (including
    nginx via underscores_in_headers off;).

    Headers containing underscores are now ignored by ASGIRequest, matching
    the behavior of Daphne, the reference server for ASGI.

    This issue has severity “low” according to the Django security policy.

* CVE-2026-4277: Privilege abuse in GenericInlineModelAdmin¶

    Add permissions on inline model instances were not validated on
    submission of forged POST data in GenericInlineModelAdmin.

    This issue has severity “low” according to the Django security policy.

* CVE-2026-4292: Privilege abuse in ModelAdmin.list_editable¶

    Admin changelist forms using list_editable incorrectly allowed new
    instances to be created via forged POST data.

    This issue has severity “low” according to the Django security policy.

* CVE-2026-33033: Potential denial-of-service vulnerability in
    MultiPartParser via base64-encoded file upload¶

    When using django.http.multipartparser.MultiPartParser, multipart
    uploads with Content-Transfer-Encoding: base64 that include excessive
    whitespace may trigger repeated memory copying, potentially degrading
    performance.

    This issue has severity “moderate” according to the Django security policy.

* CVE-2026-33034: Potential denial-of-service vulnerability in
    ASGI requests via memory upload limit bypass¶

    ASGI requests with a missing or understated Content-Length header could
    bypass the DATA_UPLOAD_MAX_MEMORY_SIZE limit when reading
    HttpRequest.body, potentially loading an unbounded request body into
    memory and causing service degradation.

    This issue has severity “low” according to the Django security policy.

Bugfixes:
* Fixed a regression in Django 6.0 where alogin() and alogout() did not
  respectively set or clear request.user if it had already been
  materialized (e.g., by sync middleware) (#37017).
* Fixed a regression in Django 6.0 in admin forms where
  RelatedFieldWidgetWrapper incorrectly wrapped all widgets in a
  <fieldset> (#36949).
* Fixed a bug in Django 6.0 where the fields.E348 system check did not
  detect name clashes between model managers and related_names for
  non-self-referential relationships (#36973).

Release Notes:
https://docs.djangoproject.com/en/6.0/releases/6.0.4/

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 60ce218196)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 14:06:29 +02:00
Titouan Christophe
a07b4bb16a package/openvpn: security bump to v2.6.20
See the release notes:
https://github.com/OpenVPN/openvpn/blob/v2.6.20/Changes.rst

This fixes 2 security issues:
- CVE-2026-40215:
    race condition in TLS handshake that could lead to leaking of packet
    data from a previous handshake under specific circumstances
- CVE-2026-35058:
    server ASSERT() on receiving a suitably malformed packet with a valid
    tls-crypt-v2 key

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
(cherry picked from commit 1a4a04fe29)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 14:06:00 +02:00
Adrian Perez de Castro
5578590f1e package/webkitgtk: security bump to 2.52.3
This bumps WebKitGTK to the 2.52 stable series. A welcome change
is the addition of the USE_GSTREAMER CMake option that can be used
as a blanket option to toggle all multimedia support, which matches
exactly the intention behind BR2_PACKAGE_WEBKITGTK_MULTIMEDIA.

Includes fixes (among others) for CVE-2026-20643, CVE-2026-20664,
CVE-2026-20665, CVE-2026-20691, CVE-2026-28857, CVE-2026-28859,
CVE-2026-28861, CVE-2026-28871, CVE-2025-43457, CVE-2025-46299,
CVE-2026-20608, CVE-2026-20635, CVE-2026-20636, CVE-2026-20644,
CVE-2026-20652, and CVE-2026-20676.

Highlights of the 2.52 series:
- https://webkitgtk.org/2026/03/18/webkitgtk-2.52-highlights.html

Release notes:
- https://webkitgtk.org/2026/04/16/webkitgtk2.52.3-released.html
- https://webkitgtk.org/2026/04/13/webkitgtk2.52.2-released.html
- https://webkitgtk.org/2026/03/27/webkitgtk2.52.1-released.html
- https://webkitgtk.org/2026/03/18/webkitgtk2.52.0-released.html
- https://webkitgtk.org/2026/03/12/webkitgtk2.50.6-released.html

Security advisories:
- https://webkitgtk.org/security/WSA-2026-0002.html
- https://webkitgtk.org/security/WSA-2026-0001.html

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 6b1de564d0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 14:01:19 +02:00
Titouan Christophe
f3c3cfd7b1 package/imagemagick: security bump to v7.1.2-19
For change log, see:
https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#712-19---2026-04-12

This fixes a large number of CVEs:
- CVE-2026-28493 (since 7.1.2-16)
- CVE-2026-28494 (since 7.1.2-16)
- CVE-2026-28686 (since 7.1.2-16)
- CVE-2026-28687 (since 7.1.2-16)
- CVE-2026-28688 (since 7.1.2-16)
- CVE-2026-28689 (since 7.1.2-16)
- CVE-2026-28690 (since 7.1.2-16)
- CVE-2026-28691 (since 7.1.2-16)
- CVE-2026-28692 (since 7.1.2-16)
- CVE-2026-28693 (since 7.1.2-16)
- CVE-2026-30883 (since 7.1.2-16)
- CVE-2026-30929 (since 7.1.2-16)
- CVE-2026-30931 (since 7.1.2-16)
- CVE-2026-30935 (since 7.1.2-16)
- CVE-2026-30936 (since 7.1.2-16)
- CVE-2026-30937 (since 7.1.2-16)
- CVE-2026-31853 (since 7.1.2-16)
- CVE-2026-32259 (since 7.1.2-16)
- CVE-2026-32636 (since 7.1.2-17)
- CVE-2026-33535 (since 7.1.2-18)
- CVE-2026-33536 (since 7.1.2-18)
- CVE-2026-33899 (since 7.1.2-19)
- CVE-2026-33900 (since 7.1.2-19)
- CVE-2026-33901 (since 7.1.2-19)
- CVE-2026-33902 (since 7.1.2-19)
- CVE-2026-33905 (since 7.1.2-19)
- CVE-2026-33908 (since 7.1.2-19)
- CVE-2026-34238 (since 7.1.2-19)
- CVE-2026-40169 (since 7.1.2-19)
- CVE-2026-40183 (since 7.1.2-19)
- CVE-2026-40310 (since 7.1.2-19)
- CVE-2026-40311 (since 7.1.2-19)
- CVE-2026-40312 (since 7.1.2-19)

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
[Julien: add link to change log in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 08d0c76171)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 14:01:05 +02:00
Bernd Kuhls
eff9a8c4e2 package/squid: security bump version to 7.5
https://github.com/squid-cache/squid/blob/SQUID_7_5/ChangeLog

Fixes:
https://www.cve.org/CVERecord?id=CVE-2026-32748
https://www.cve.org/CVERecord?id=CVE-2026-33515
https://www.cve.org/CVERecord?id=CVE-2026-33526

Removed patches which are included in this release.

Switched to tarball hash provided by upstream.

Updated license hash due to upstream commit
30a55c0819

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: mark the commit as "security" bump, add CVE links]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 5990674340)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 14:00:01 +02:00
Titouan Christophe
a2c0cd7ec4 package/log4cxx: security bump to v1.7.0
For change log, see:
https://logging.apache.org/log4cxx/1.7.0/changelog.html

This fixes the following vulnerability:
- CVE-2026-40023:
    Apache Log4cxx's XMLLayout
    https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayout.html,
    in versions before 1.7.0, fails to sanitize characters forbidden
    by the  XML 1.0 specification https://www.w3.org/TR/xml/#charsets
    in log messages, NDC, and MDC property keys and values, producing
    invalid XML output. Conforming XML parsers must reject such
    documents with a fatal error, which may cause downstream log
    processing systems to drop or fail to index affected records.
    An attacker who can influence logged data can exploit this
    to suppress individual log records, impairing audit trails and
    detection of malicious activity.  Users are advised to upgrade to
    Apache Log4cxx 1.7.0, which fixes this issue.
    https://www.cve.org/CVERecord?id=CVE-2026-40023

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
[Julien: add link to change log in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 1d5c6d18da)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 13:59:14 +02:00
Julien Olivain
2887dd91cc package/python-magic-wormhole: security bump to version 0.23.0
See NEWS:
https://github.com/magic-wormhole/magic-wormhole/blob/0.23.0/NEWS.md

This commit also updates _SITE to use a stable URL which will redirect
to the package archive, to reduce future maintenance.

Fixes:
https://nvd.nist.gov/vuln/detail/CVE-2026-32116

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit 8de4776c60)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 13:58:27 +02:00
Julien Olivain
6873a1beab package/python-magic-wormhole: add CPE ID
The CPE ID `magic_wormhole_project:magic_wormhole` is valid for
magic-wormhole. See:
https://nvd.nist.gov/products/cpe/detail/591D7832-786D-4BBD-A16A-04CBDE20333B

This commit adds the information.

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit 298390ade4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 13:57:32 +02:00
Bernd Kuhls
94e54141f9 package/libspdm: security bump version to 3.8.2
https://github.com/DMTF/libspdm/releases/tag/3.8.2

This release brings a fix for the security issues described in
https://github.com/DMTF/libspdm/security/advisories/GHSA-j54w-759w-xj3m
https://github.com/DMTF/libspdm/security/advisories/GHSA-m4wc-xmvg-369f

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 80898249b7)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 13:51:28 +02:00
Bernd Kuhls
c835846174 package/ruby: security bump version to 4.0.3
https://www.ruby-lang.org/en/news/2026/04/21/ruby-4-0-3-released/

Added sha512 tarball hash provided by upstream.

Fixes CVE-2026-41316:
https://www.ruby-lang.org/en/news/2026/04/21/erb-cve-2026-41316/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 92746d0dea)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 13:49:49 +02:00
Waldemar Brodkorb
66221b107d package/ruby: bump to 4.0.2
See here for news in the release:
https://www.ruby-lang.org/en/news/2026/03/16/ruby-4-0-2-released/

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 8937414d68)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 13:49:43 +02:00
Fiona Klute
d9e4d86cb0 package/musl: add upstream security patches for CVE-2026-40200
Fixes CVE-2026-40200: musl libc: stack corruption in qsort with
sufficiently large inputs
https://www.openwall.com/lists/musl/2026/04/10/3

Fixes: https://nvd.nist.gov/vuln/detail/CVE-2026-40200

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e96e63dc0e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 13:49:17 +02:00
Fiona Klute
fe306a4df2 package/musl: add upstream security patch for CVE-2026-6042
Fixes CVE-2026-6042: musl libc: Algorithmic complexity DoS in iconv
GB18030 decoder
https://www.openwall.com/lists/oss-security/2026/04/09/19

Fixes: https://nvd.nist.gov/vuln/detail/CVE-2026-6042

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit b5ff02164f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 13:48:27 +02:00
Thomas Perale
b9ff9c9957 package/mbedtls: security bump to v3.6.6
For more information about the release, see:

- https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-3.6.6
- https://github.com/Mbed-TLS/mbedtls/compare/mbedtls-3.6.5..mbedtls-3.6.6

Fixes the following vulnerabilities:

- CVE-2025-66442
    In Mbed TLS through 4.0.0, there is a compiler-induced timing side
    channel (in RSA and CBC/ECB decryption) that only occurs with LLVM's
    select-optimize feature. TF-PSA-Crypto through 1.0.0 is also affected.

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2025-66442
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-compiler-induced-constant-time-violations/

- CVE-2026-25833:
    Mbed TLS 3.5.0 to 3.6.5 fixed in 3.6.6 and 4.1.0 has a buffer overflow
    in the x509_inet_pton_ipv6() function

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-25833
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-inet-pton/

- CVE-2026-25834:
    Mbed TLS v3.3.0 up to 3.6.5 and 4.0.0 allows Algorithm Downgrade.

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-25834
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-sigalg-injection/

- CVE-2026-25835:
    Mbed TLS before 3.6.6 and TF-PSA-Crypto before 1.1.0 misuse seeds in a
    Pseudo-Random Number Generator (PRNG).

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-25835
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-rng-cloning/

- CVE-2026-34871:
    An issue was discovered in Mbed TLS before 3.6.6 and 4.x before 4.1.0
    and TF-PSA-Crypto before 1.1.0. There is a Predictable Seed in a
    Pseudo-Random Number Generator (PRNG).

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-34871
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-dev-random/

- CVE-2026-34872:
    An issue was discovered in Mbed TLS 3.5.x and 3.6.x through 3.6.5 and
    TF-PSA-Crypto 1.0. There is a lack of contributory behavior in FFDH
    due to improper input validation. Using finite-field Diffie-Hellman,
    the other party can force the shared secret into a small set of values
    (lack of contributory behavior). This is a problem for protocols that
    depend on contributory behavior (which is not the case for TLS). The
    attack can be carried by the peer, or depending on the protocol by an
    active network attacker (person in the middle).

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-34872
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-ffdh-peerkey-checks/

- CVE-2026-34873:
    An issue was discovered in Mbed TLS 3.5.0 through 4.0.0. Client
    impersonation can occur while resuming a TLS 1.3 session.

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-34873
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-client-impersonation-while-resuming-tls13-session/

- CVE-2026-34874:
    An issue was discovered in Mbed TLS through 3.6.5 and 4.x through
    4.0.0. There is a NULL pointer dereference in distinguished name
    parsing that allows an attacker to write to address 0.

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-34874
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-null-pointer-dereference-x509/

- CVE-2026-34875:
    An issue was discovered in Mbed TLS through 3.6.5 and TF-PSA-Crypto
    1.0.0. A buffer overflow can occur in public key export for FFDH keys.

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-34875
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-ffdh-buffer-overflow/

- CVE-2026-34876:
    An issue was discovered in Mbed TLS 3.x before 3.6.6. An out-of-bounds
    read vulnerability in mbedtls_ccm_finish() in library/ccm.c allows
    attackers to obtain adjacent CCM context data via invocation of the
    multipart CCM API with an oversized tag_len parameter. This is caused
    by missing validation of the tag_len parameter against the size of the
    internal 16-byte authentication buffer. The issue affects the public
    multipart CCM API in Mbed TLS 3.x, where mbedtls_ccm_finish() can be
    invoked directly by applications. In Mbed TLS 4.x versions prior to
    the fix, the same missing validation exists in the internal
    implementation; however, the function is not exposed as part of the
    public API. Exploitation requires application-level invocation of the
    multipart CCM API.

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-34876
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-ccm-finish-boundary-check/

- CVE-2026-34877:
    An issue was discovered in Mbed TLS versions from 2.19.0 up to 3.6.5,
    Mbed TLS 4.0.0. Insufficient protection of serialized SSL context or
    session structures allows an attacker who can modify the serialized
    structures to induce memory corruption, leading to arbitrary code
    execution. This is caused by Incorrect Use of Privileged APIs.

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-34877
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-serialized-data/

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e1c7f198dc)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 13:48:11 +02:00
Thomas Perale
9678db2cc5 package/cups: security bump to v2.4.17
For more information about the release, see:

- https://github.com/OpenPrinting/cups/releases/tag/v2.4.17
- https://github.com/OpenPrinting/cups/blob/2.4.x/CHANGES.md

The new release 2.4.17 contains the following security fixes:

- CVE-2026-27447: The scheduler treated local user and group names as
  case-insensitive.
  https://www.cve.org/CVERecord?id=CVE-2026-27447

- CVE-2026-34978: The RSS notifier could write outside the scheduler's
  RSS directory.
  https://www.cve.org/CVERecord?id=CVE-2026-34978

- CVE-2026-34979: The scheduler did not always allocate enough memory
  for a job's options string.
  https://www.cve.org/CVERecord?id=CVE-2026-34979

- CVE-2026-34980: The scheduler did not filter control characters from
  option values.
  https://www.cve.org/CVERecord?id=CVE-2026-34980

- CVE-2026-34990: The scheduler incorrectly allowed local certificates
  over the loopback interface.
  https://www.cve.org/CVERecord?id=CVE-2026-34990

- CVE-2026-39314: Fixed the range check for job password strings.
  https://www.cve.org/CVERecord?id=CVE-2026-39314

- CVE-2026-39316: Fixed a printer subscription bug in the scheduler.
  https://www.cve.org/CVERecord?id=CVE-2026-39316

- CVE-2026-41079: Fixed a SNMP string conversion bug in the backends.
  https://www.cve.org/CVERecord?id=CVE-2026-41079

Also updated patch offsets.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 1f801dc616)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 13:47:54 +02:00
Bernd Kuhls
e396852da5 package/libpjsip: security bump version to 2.16
https://github.com/pjsip/pjproject/releases/tag/2.16

Fixes CVE-2025-65102:
https://github.com/pjsip/pjproject/security/advisories/GHSA-w5vr-39x7-h8g5

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit a266be923f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 13:47:36 +02:00
Bernd Kuhls
1c6afcd9f1 package/p11-kit: security bump version to 0.26.2
https://github.com/p11-glue/p11-kit/blob/0.26.2/NEWS

Fixes CVE-2026-2100: https://github.com/advisories/GHSA-hq85-3f6c-jx84

Switched to sha256 tarball hash provided by upstream.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit a5366d13ba)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 13:44:35 +02:00
Marcus Hoffmann
6b2ec19340 package/util-linux: security bump to 2.41.4
Security fixes:

 CVE-2026-27456 - mount(8) TOCTOU symlink attack via loop device.
   The SUID mount follows symlinks when resolving loop backing file
   paths. On systems where non-root users are permitted to mount loop
   devices (via 'user' option in fstab), this allows access to
   arbitrary files.

 CWE-190 - Integer overflow in libblkid parse_dos_extended().
   A crafted MBR disk image can cause uint32_t wraparound in EBR
   chain processing, causing reported partitions to not match the
   on-disk layout. Tools like udisks may then register a partition
   at logical sector 0.

Full release notes: https://www.kernel.org/pub/linux/utils/util-linux/v2.41/v2.41.4-ReleaseNotes

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit cd52acda14)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 13:41:23 +02:00
Titouan Christophe
152acddfa7 {linux, linux-headers}: bump 6.12.x, 6.6.x, 6.19.x, 6.18.x series
Update the latest kernel releases to:
 - 6.12.82 -> 6.12.84
 - 6.6.135 -> 6.6.136
 - 6.19.13 -> 6.19.14
 - 6.18.23 -> 6.18.25

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2026-04-29 15:24:44 +02:00
Titouan Christophe
0be927b89a package/systemd: security bump to v258.7
This fixes the following vulnerabilities:

- CVE-2026-29111 (fixed in 258.5):
    systemd, a system and service manager, (as PID 1) hits an assert and
    freezes execution when an unprivileged IPC API call is made with
    spurious data. On version v249 and older the effect is not an assert,
    but stack overwriting, with the attacker controlled content. From
    version v250 and newer this is not possible as the safety check causes
    an assert instead. This IPC call was added in v239, so versions older
    than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11
    contain patches. No known workarounds are available.
    https://www.cve.org/CVERecord?id=CVE-2026-29111

- CVE-2026-40226 (fixed in 258.6):
    In nspawn in systemd 233 through 259 before 260, an escape-to-host
    action can occur via a crafted optional config file.
    https://www.cve.org/CVERecord?id=CVE-2026-40226
    https://github.com/systemd/systemd/security/advisories/GHSA-9mj4-rrc3-gjcx

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
[Marcus: note which minor versions included the respective security fixes]
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit f6e0ad3858)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-23 14:33:50 +02:00
Shubham Chakraborty
8fd2727270 DEVELOPERS: add Shubham Chakraborty as pv maintainer
Signed-off-by: Shubham Chakraborty <chakrabortyshubham66@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit bf7c35d4f7)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-23 14:33:04 +02:00
Julien Olivain
2b6eab392d package/mkpasswd: add dependency to host-libxcrypt
The host-mkpasswd package needs the <crypt.h> header file installed
on the host. This file was initially provided by the libc headers,
as part of its libcrypt implementation. libcrypt was removed in
glibc 2.39. Most Linux distributions continued to ship a libcrypt
replacement such as libxcrypt in their default installation.

Some mainstream Linux distribution (such as Debian testing) are
now starting to remove this libcrypt and <crypt.h> header from their
default image (of development files).

In that case, host-mkpasswd is failing to build with the error:

    /buildroot/output/build/host-mkpasswd/mkpasswd.c:54:10: fatal error: crypt.h: No such file or directory

The issue can be reproduced by adapting the Buildroot Docker file,
by setting "FROM debian:testing-20260316" in [1] and removing
the build of tar.

Note: debian 13 (for example Docker tag trixie-20260316) still
includes the libcrypt-dev package by default, which provides crypt.h.

In Buildroot, there is already the host-heimdal and host-systemd
packages requiring host-libxcrypt. Also, the host-libxcrypt is a
small standalone package. For those reasons, instead of adding
the Buildroot prerequisite on the user host to provide a libcrypt
implementation, this commit simply add the package dependency to
host-libxcrypt, to make sure it will work in all situations.

[1] https://gitlab.com/buildroot.org/buildroot/-/blob/2026.02/support/docker/Dockerfile#L11

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit cf26c77280)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-23 14:31:48 +02:00
Julien Olivain
cc627f2c67 package/libjxl: security bump to version 0.11.2
For release notes since v0.11.1, see:
https://github.com/libjxl/libjxl/releases/tag/v0.11.2

Fixes:
https://www.cve.org/cverecord?id=CVE-2025-12474
https://www.cve.org/cverecord?id=CVE-2026-1837

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit ccf69ab8c4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-23 14:30:11 +02:00
Titouan Christophe
e4b3bdb663 package/dash: add patch for CVE-2026-31323
The vulnerability description is not disclosed yet.

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
(cherry picked from commit 7e24f892f6)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-23 14:29:25 +02:00
Bernd Kuhls
7a1f92b0df package/libmicrohttpd: security bump version to 1.0.5
https://lists.gnu.org/archive/html/libmicrohttpd/2026-04/msg00003.html

Fixes CWE-444: https://cwe.mitre.org/data/definitions/444.html

Version 1.0.4 contains a bug and was never officially announced:
https://lists.gnu.org/archive/html/libmicrohttpd/2026-04/msg00002.html

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 712121326f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-23 14:26:56 +02:00
Bernd Kuhls
e898ab668f package/ghostscript: security bump to version 10.07.0
https://ghostscript.readthedocs.io/en/gs10.07.0/News.html
"This release addresses CVEs: TBC (Two applied for)"

Removed patch which is included in this release.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 6216be221f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-23 14:26:25 +02:00
Bernd Kuhls
7c9a398eba package/ghostscript: Fix brotli build failure on ARMv7
Fixes:
https://autobuild.buildroot.net/results/9e3/9e3435752d50ed3db55b0ff03e412bf42728f73a/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 2965d8af98)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-23 14:25:38 +02:00
Adrian Perez de Castro
67692112f7 package/xdg-dbus-proxy: security bump to version 0.1.7
While there is not a security advisory to go with the release,
it includes a patch to prevent message interception that may be
considered a security fix.

Release notes:

  https://github.com/flatpak/xdg-dbus-proxy/releases/tag/0.1.7

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 188fad7af1)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-23 14:25:15 +02:00
Bernd Kuhls
3082413b9b package/libarchive: security bump version to 3.8.7
https://github.com/libarchive/libarchive/releases/tag/v3.8.7
"Libarchive 3.8.7 is a security and bugfix release."

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 5fc186771e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-23 14:24:12 +02:00
Bernd Kuhls
2513ab9603 package/libexif: security bump to version 0.6.26
https://github.com/libexif/libexif/blob/v0.6.26/NEWS

* Security issues fixed:
  * CVE-2026-40386: An unsigned integer underflow in Fuji and Olympus
    makernote handling
  * CVE-2026-40385: An unsigned integer overflow on 32bit systems in
    Nikon makernote handling
  * CVE-2026-32775: A buffer overwrite via integer underflow in makernote
    handling

Switched to xz tarball and tarball hash provided by upstream.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 3f9bcf42c3)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-23 14:23:43 +02:00
Marcus Hoffmann
2e3c080b98 package/bat: remove no longer needed patch for gcc15 compat
The bat 0.26.0 already depends on a newer version of the onig_sys crate,
so the problem that patch is fixing was no already no longer present.

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 0e2b7e2bee)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-23 14:23:09 +02:00
Bernd Kuhls
d1c44f8cdf package/wolfssl: security bump version to 5.9.1
https://github.com/wolfSSL/wolfssl/blob/v5.9.1-stable/ChangeLog.md

Restored patch 0001 to its original state.

Updated license hashes due to upstream commits:

"updating license from GPLv2 to GPLv3"
629c5b4cf6

"Add GPLv2 exception list to LICENSING"
e02de78507

with various follow-up commits:
0d49df7735
32d33f2a53
1e9d71af42
18332faa05

Fixes the following CVEs:

* [High] CVE-2026-5264
* [High] CVE-2026-5263
* [High] CVE-2026-5295
* [High] CVE-2026-5466
* [High] CVE-2026-5477
* [High] CVE-2026-5447
* [High] CVE-2026-5500
* [High] CVE-2026-5501
* [High] CVE-2026-5503
* [Low] CVE-2026-5187
* [Low] CVE-2026-5188
* [Low] CVE-2026-5448
* [Low] CVE-2026-5772
* [Low] CVE-2026-5778
* [High] CVE-2026-3548
* [High] CVE-2026-3549
* [High] CVE-2026-3547
* [Low] CVE-2026-0819
* [Low] CVE-2026-1005
* [Low] CVE-2026-2645
* [Low] CVE-2026-3230
* [Low] CVE-2025-12888
* [Med.] CVE-2025-11936
* [Low] CVE-2025-11935
* [Low] CVE-2025-11934
* [Low] CVE-2025-11933
* [Low] CVE-2025-11931
* [Low] CVE-2025-11932
* [Low] CVE-2025-12889
* [Low] CVE-2025-13912
* [High] CVE-2025-7395
* [Med.] CVE-2025-7394
* [Low] CVE-2025-7396

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 99f8ed1212)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-23 14:22:47 +02:00
Bernd Kuhls
fadcabd086 package/wolfssl: fix build with libcurl >= 8.19.0
wolfssl requires definition of SIZEOF_LONG_LONG. Commit 3a5e071e4f
("package/libcurl: security bump to version 8.19.0") removed
SIZEOF_LONG_LONG definitions from libcurl autotools build system,
breaking build with wolfssl.

Fixes:
https://autobuild.buildroot.net/results/baa/baa74a47464ed3e21d0adad64dd0c7c708c9ef85/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 50feb87384)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-23 14:22:25 +02:00
Bernd Kuhls
b6474fc1c4 package/wolftpm: security bump version to 3.10.0
https://github.com/wolfSSL/wolfTPM/blob/v3.10.0/ChangeLog.md

Version 3.9.2 fixes CVE-2025-7844:
https://github.com/wolfSSL/wolfTPM/pull/427

Upstream switched from GPL-2.0+ to GPL-3.0+ with version 3.9.2:
1402d0d132

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 482a8e61fa)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-23 14:22:00 +02:00
Bernd Kuhls
ceb27f0f04 package/strongswan: security bump version to 6.0.5
https://github.com/strongswan/strongswan/releases/tag/6.0.5

Switched _SITE to https.

Fixes CVE-2026-25075.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit cc7c20d817)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-23 14:19:32 +02:00
Bernd Kuhls
64e67580da package/strongswan: remove unneeded wolfSSL fix
Using this defconfig

BR2_x86_64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_PER_PACKAGE_DIRECTORIES=y
BR2_PACKAGE_STRONGSWAN=y
BR2_PACKAGE_STRONGSWAN_WOLFSSL=y

applied after 'git reset 10a70b1af6 --hard'

replicates the build error
http://autobuild.buildroot.net/results/278b3f74c48c858ae368d59069752adb69c05246

which was fixed in 2024 by
89d512729c

Note: The git tree was reset to the commit right before the fix.

Instead of using the fix mentioned above the build error is also fixed
when the buildroot commit 6c18375434 is
cherry-picked onto 10a70b1af6.

This means the build error mentioned above is really fixed by enabling
BR2_PACKAGE_WOLFSSL_ALL. Therefore we can remove the content of commit
89d512729c.

This commit also prevents a build error in strongswan

wolfssl_rsa_private_key.c: In function 'create_empty':
wolfssl_rsa_private_key.c:450:18: error: 'RsaKey' has no member named 'rng'
  450 |         this->rsa.rng = &this->rng;

caused by the upcoming bump of wolfSSL from 5.7.2 to 5.9.1 due to
upstream commit
cd88a8ae88
which was first included in wolfSSL 5.9.0.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 5d6378db9d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-23 14:19:21 +02:00
Bernd Kuhls
460d0ebf95 package/x11r7/xwayland: security bump version to 24.1.10
https://lists.x.org/archives/xorg-announce/2026-April/003679.html

Updated license hash due to upstream commits:
e5c6a5ab90
89f82cce4a

Fixes the following CVEs:

* CVE-2026-33999: XKB Integer Underflow in XkbSetCompatMap()
* CVE-2026-34000: XKB Out-of-bounds Read in CheckSetGeom()
* CVE-2026-34001: XSYNC Use-after-free in miSyncTriggerFence()
* CVE-2026-34002: XKB Out-of-bounds read in CheckModifierMap()
* CVE-2026-34003: XKB Buffer overflow in CheckKeyTypes()

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 40f8603e6a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-23 14:16:36 +02:00
Bernd Kuhls
ed0266aa51 package/x11r7/xserver_xorg-server: security bump version to 21.1.22
https://lists.x.org/archives/xorg-announce/2026-April/003678.html

Updated license hash due to upstream commits:
3069f64d69
dd924b160c

Fixes the following CVEs:

* CVE-2026-33999: XKB Integer Underflow in XkbSetCompatMap()
* CVE-2026-34000: XKB Out-of-bounds Read in CheckSetGeom()
* CVE-2026-34001: XSYNC Use-after-free in miSyncTriggerFence()
* CVE-2026-34002: XKB Out-of-bounds read in CheckModifierMap()
* CVE-2026-34003: XKB Buffer overflow in CheckKeyTypes()

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 0136eba110)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-23 14:13:08 +02:00
Bernd Kuhls
66a249753e package/c-icap: fix musl build
Fixes:
https://autobuild.buildroot.net/results/33b/33bb3ea8ac36da7f40a82c580d3614f0b34a7ab2/

The oldest build error dates back to June 2024 so this patch should be
backported to LTS branches.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 428e0e292b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-23 14:10:48 +02:00
Titouan Christophe
b79ab7b812 {linux, linux-headers}: bump 6.12.x, 6.6.x, 6.1.x, 5.15.x, 5.10.x, 6.19.x, 6.18.x series
Update the latest kernel releases to:
 - 6.12.81 -> 6.12.82
 - 6.6.134 -> 6.6.135
 - 6.1.168 -> 6.1.169
 - 5.15.202 -> 5.15.203
 - 5.10.252 -> 5.10.253
 - 6.19.12 -> 6.19.13
 - 6.18.22 -> 6.18.23

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2026-04-23 13:48:25 +02:00
Arnout Vandecappelle
0141ca3fa5 Makefile: Update for 2026.02.1
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2026-04-21 23:03:56 +02:00
Arnout Vandecappelle
b1cb4bc509 CHANGES: Update for 2026.02.1
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2026-04-21 20:26:13 +02:00
Bernd Kuhls
d04c454ac3 package/libopenssl: security bump to version 3.6.2
https://openssl-library.org/post/2026-04-07-release-announcement/

Fixes the following vulnerabilities:

CVE-2026-31790 - Incorrect Failure Handling in RSA KEM RSASVE Encapsulation.
CVE-2026-28386 - Out-of-bounds Read in AES-CFB-128 on X86-64 with AVX-512 Support.
CVE-2026-28387 - Potential Use-after-free in DANE Client Code.
CVE-2026-28388 - NULL Pointer Dereference When Processing a Delta CRL.
CVE-2026-28389 - Possible NULL Dereference When Processing CMS KeyAgreeRecipientInfo.
CVE-2026-28390 - Possible NULL Dereference When Processing CMS KeyTransportRecipientInfo.
CVE-2026-31789 - Heap Buffer Overflow in Hexadecimal Conversion.

Removed patch 0004 which is included in this release, merged in:
7936b4c415

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 58d2330b62)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-17 18:17:03 +02:00
Bernd Kuhls
e40a802ba3 package/php: bump version to 8.5.5
https://www.php.net/ChangeLog-8.php#8.5.5
https://news-web.php.net/php.announce/488

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 1014d8ffb6)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-17 17:21:31 +02:00
Marcus Hoffmann
67f7393f1b package/python-gpiod: security bump to 2.4.2
Update for libgpiod v2.2.4.
Contains the following security fix:
https://git.kernel.org/pub/scm/libs/libgpiod/libgpiod.git/commit/?h=python-v2.4.x&id=c3655b5f641b87656c11da3ac708608d2c0e05ee

The package now contains a proper LICENSE file in the sdist since:
https://git.kernel.org/pub/scm/libs/libgpiod/libgpiod.git/commit/?h=python-v2.4.x&id=51ee19fe1ec8a94b5ecfdc7627b0c574c7874a1b

Note: this commit is marked as "security" update because it contains
security related bugfixes, but no CVE or advisory are published at
the time of this commit.

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
[Julien: add note in the commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 8b965c2665)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-17 17:21:29 +02:00
Marcus Hoffmann
6b8cb03a4a package/libgpiod2: security bump to 2.2.4
Bug fixes:
- fix buffer over-read bugs when translating uAPI structs to library types
- fix variable and argument types where necessary
- sanitize values returned by the kernel to avoid potential buffer overflows
- fix memory leaks in gpio-tools
- add missing return value checks in gpio-tools
- fix period parsing in gpio-tools
- use correct loop counter in error path in gpio-manager

Improvements:
- make tests work with newer coreutils by removing cases checking tools'
  behavior on SIGINT which stopped working due to changes in behavior of the
  timeout tool

See: https://git.kernel.org/pub/scm/libs/libgpiod/libgpiod.git/tree/NEWS?h=v2.2.4

Note: this commit is marked as "security" update because it contains
security related bugfixes, but no CVE or advisory are published at
the time of this commit.

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
[Julien: add note in the commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 6ac53518a0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-17 17:21:27 +02:00
Michael Nosthoff
60748b81af package/libgpiod2: bump to version 2.2.3
Changelog:
https://git.kernel.org/pub/scm/libs/libgpiod/libgpiod.git/tree/NEWS?h=v2.2.3

Signed-off-by: Michael Nosthoff <buildroot@heine.tech>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit 1afd1a6d4d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-17 17:21:25 +02:00
Gary Bisson
fc52ce0ef6 configs/nitrogen*: switch to bootlin toolchain
As recommended by Julien[1].

[1] https://lists.buildroot.org/pipermail/buildroot/2026-April/800059.html

Signed-off-by: Gary Bisson <bisson.gary@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 8c655ac80c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-17 17:21:23 +02:00
Giulio Benetti
d7da44f6da package/wireshark: security bump to v4.4.14
For more information on the version bump, see:
  - https://www.wireshark.org/docs/relnotes/wireshark-4.4.14.html

Fixes the following vulnerabilities:

- CVE-2026-3201:
    USB HID dissector memory exhaustion in Wireshark 4.4.0 to 4.4.13 and 4.6.0 to
    4.6.3 allows denial of service

    https://www.cve.org/CVERecord?id=CVE-2026-3201

- CVE-2026-3203:
    RF4CE Profile dissector crash in Wireshark 4.4.0 to 4.4.13 and 4.6.0 to
    4.6.3 allows denial of service

    https://www.cve.org/CVERecord?id=CVE-2026-3203

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit 9639bb44c7)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-17 17:21:21 +02:00
Yegor Yefremov
930b6d3930 package/libftdi1: enable static only build
libfdti1 provides configuration options SHAREDLIBS and STATICLIBS
that allow any combination of static/shared libraries.

Fixes:
https://autobuild.buildroot.org/results/d7b9a45ccffc1c9e3fd796c3e46ee396b7d88272/

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
[Marcus: explicitly check for BR2_SHARED_STATIC_LIBS]
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit 0a9b365de4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-17 17:21:19 +02:00
Christian Stewart
1b5a7bb021 package/go: security bump to version 1.26.2
go1.26.2 (released 2026-04-07) includes security fixes to the go command, the
compiler, and the archive/tar, crypto/tls, crypto/x509, html/template, and os
packages, as well as bug fixes to the go command, the go fix command, the
compiler, the linker, the runtime, and the net, net/http, and net/url packages.

CVE-2026-32289: html/template: JS template literal context incorrectly tracked
CVE-2026-33810: crypto/x509: excluded DNS constraints not properly applied to wildcard domains
CVE-2026-27144: cmd/compile: no-op interface conversion bypasses overlap checking
CVE-2026-27143: cmd/compile: possible memory corruption after bound check elimination
CVE-2026-32288: archive/tar: unbounded allocation when parsing old format GNU sparse map
CVE-2026-32283: crypto/tls: multiple key update handshake messages can cause connection to deadlock
CVE-2026-27140: cmd/go: trust layer bypass when using cgo and SWIG
CVE-2026-32280: crypto/x509: unexpected work during chain building
CVE-2026-32281: crypto/x509: inefficient policy validation

https://go.dev/doc/devel/release#go1.26.2
https://github.com/golang/go/issues?q=milestone%3AGo1.26.2+label%3ACherryPickApproved

Signed-off-by: Christian Stewart <christian@aperture.us>
[Julien: add "security" in commit log title]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 82518f8cb4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-17 17:21:17 +02:00
Titouan Christophe
fc8111fcd1 package/redis: security bump to v8.4.2
See the release notes:
https://github.com/redis/redis/blob/8.4.2/00-RELEASENOTES

================================================================================
Redis 8.4.2    Released Mon 23 Feb 2026 10:00:00 IST
================================================================================

SECURITY: There is a security fix in the release

- A user can manipulate data read by a connection by injecting \r\n sequences
  into a Redis error reply

================================================================================
Redis 8.4.1    Released Sun 8 Feb 2026 9:00:00 IST
================================================================================

Update urgency: `SECURITY`: There are security fixes in the release.

- #T1837, #J1474 Hide Personally Identifiable Information from server log
- #P936 Cuckoo filter: crash on RDB load on 0 buckets (MOD-11593)
- #P945 Bloom filter: crash on RDB load on large number of filters (MOD-11590)

(And a whole lot of other bugfixes)

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 29a4927157)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-17 17:21:15 +02:00
Bernd Kuhls
f7ea0c8aa0 package/libcap: security bump version to 2.78
Release notes:
https://sites.google.com/site/fullycapable/release-notes-for-libcap#h.x4zn8j3lss6r

Removed patch which is included in this release.

Fixes CVE-2026-4878.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 76e4d8e3df)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-17 17:21:13 +02:00
Bernd Kuhls
e96084eb61 package/python3: security bump version to 3.14.4
https://www.python.org/downloads/release/python-3144/
https://docs.python.org/release/3.14.4/whatsnew/changelog.html

Fixes
CVE 2026-4224: https://www.cve.org/CVERecord?id=CVE-2026-4224
CVE 2026-3644: https://www.cve.org/CVERecord?id=CVE-2026-3644
CVE 2026-2297: https://www.cve.org/CVERecord?id=CVE-2026-2297

Rebased patch 0010 due to upstream commit
616e611844

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f862711b10)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-17 17:21:11 +02:00
Bernd Kuhls
a9d1714fb2 package/libpng: security bump to version 1.6.57
https://github.com/pnggroup/libpng/blob/v1.6.57/ANNOUNCE

Fixes CVE-2026-34757:
https://github.com/pnggroup/libpng/security/advisories/GHSA-6fr7-g8h7-v645

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit ad5faa474c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-17 17:21:10 +02:00
Michael Nosthoff
e714e38a87 package/libglib2: security bump to version 2.86.5
Fix several security vulnerabilities of varying severity.

Release Notes:
https://gitlab.gnome.org/GNOME/glib/-/releases/2.86.3
https://gitlab.gnome.org/GNOME/glib/-/releases/2.86.4
https://gitlab.gnome.org/GNOME/glib/-/releases/2.86.5

Fixes:
- CVE-2025-13601
- CVE-2026-1484
- CVE-2026-1485
- CVE-2026-1489

Signed-off-by: Michael Nosthoff <buildroot@heine.tech>
[Julien:
 - fix URL in hash file comment
 - add "security" in commit log title
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit b9ea86b26a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-17 17:21:08 +02:00
Bernd Kuhls
d29bfbd6a3 package/libde265: security bump version to 1.0.18
https://github.com/strukturag/libde265/releases/tag/v1.0.18

https://github.com/strukturag/libde265/releases/tag/v1.0.17
Fixes CVE-2026-33164 & CVE-2026-33165.

Used sha256 tarball hash provided by upstream.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d4b8a42fb2)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-17 17:21:06 +02:00
Julien Olivain
bbfbabcc50 arch: mark a set of target configurations as secondary
Those target configurations marked as "secondary" will be tested with a
lower probability in autobuilders. The intent is to focus the Buildroot
development (and bugfixes) on mainstream configurations, while still
keeping some other, less common, configurations.

This commit marks the following CPU architectures as secondary:

BR2_arcle (ARC little endian)
BR2_armeb (ARM big endian)
BR2_aarch64_be (AArch64 big endian)
BR2_hppa (PA-RISC)
BR2_loongarch64
BR2_m68k
BR2_microblazeel (Microblaze AXI, little endian)
BR2_microblazebe (Microblaze non-AXI, big endian)
BR2_mips (MIPS, big endian)
BR2_mipsel (MIPS, little endian)
BR2_mips64 (MIPS64 big endian)
BR2_or1k (OpenRISC)
BR2_powerpc (PowerPC, big endian)
BR2_powerpc64 (PowerPC64, big endian)
BR2_s390x
BR2_sh (SuperH)
BR2_sparc
BR2_sparc64
BR2_xtensa

In the following CPU architecture, only specific configurations are
marked secondary:

In BR2_armeb (ARM little endian),
- armv4 cores (arm920t, arm922t, fa526/626, strongarm sa110/sa1100)

In BR2_riscv:
- all 32-bit configurations
- 64-bit no-MMU

In BR2_i386 (x86 32-bit),
- i486, i586 and X1000 CPU

There was no strict rule established to build this list of secondary
configurations. This list was built mainly from the observation of
which architecture/CPUs are still widely used in the field
(disregarding its age), the quality of their upstream support and
the general relevance in the Buildroot project.

Signed-off-by: Julien Olivain <ju.o@free.fr>
[Arnout: use !BR2_HIDE_SECONDARY_TARGET_OPTIONS instead of
BR2_SHOW_SECONDARY_TARGET_OPTIONS]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit ddce0814a7)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-17 17:21:04 +02:00
Julien Olivain
bf5c58e0d3 Config.in, Makefile: add BR2_HIDE_SECONDARY_TARGET_OPTIONS
The option is currently unused, which leads to a check-symbol warning.

Suggested-by: Arnout Vandecappelle <arnout@rnout.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
[Arnout: squash two patches]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 4642f903cd)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-17 17:21:02 +02:00
Francois Perrad
2512acc862 package/quickjs: security bump to version 2025-09-13
fixes this serie of CVE:
https://security-tracker.debian.org/tracker/CVE-2025-62490
https://security-tracker.debian.org/tracker/CVE-2025-62491
https://security-tracker.debian.org/tracker/CVE-2025-62492
https://security-tracker.debian.org/tracker/CVE-2025-62493
https://security-tracker.debian.org/tracker/CVE-2025-62494
https://security-tracker.debian.org/tracker/CVE-2025-62495
https://security-tracker.debian.org/tracker/CVE-2025-62496

For release notes, see:
https://bellard.org/quickjs/Changelog

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit ac4c32f6f8)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-17 17:21:00 +02:00
Bernd Kuhls
39ca2c22b2 package/libmicrohttpd: security bump version to 1.0.3
https://lists.gnu.org/archive/html/info-gnu/2026-04/msg00000.html

Fixes the following vulnerabilities:

- CVE-2025-59777

See https://nvd.nist.gov/vuln/detail/CVE-2025-59777

- CVE-2025-62689

See https://nvd.nist.gov/vuln/detail/CVE-2025-62689

Switched project URL to https.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 8218689810)
[thomas: added security mention]
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-17 17:20:58 +02:00
Titouan Christophe
d86dc1a48e {linux, linux-headers}: bump 6.12.x, 6.6.x, 6.1.x, 6.19.x, 6.18.x series
Update the latest kernel releases to:
 - 6.12.79 -> 6.12.81
 - 6.6.130 -> 6.6.134
 - 6.1.167 -> 6.1.168
 - 6.19.10 -> 6.19.12
 - 6.18.20 -> 6.18.22

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2026-04-17 17:20:56 +02:00
Bernd Kuhls
7cd8b4791d package/xz: security bump version to 5.8.3
https://github.com/tukaani-project/xz/releases/tag/v5.8.3

Fixes CVE-2026-34743.

Switched to sha256 tarball provided by upstream.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 7246352273)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-15 08:17:44 +02:00
Bernd Kuhls
a3ef297e0e package/xz: bump version to 5.8.2
https://github.com/tukaani-project/xz/releases/tag/v5.8.2
"- Fix the build on ARM64 on glibc versions older than
   2.24 (2016). They don't have HWCAP_CRC32 in <sys/auxv.h>."

Updated license hashes due to upstream commit
6d287a3ae9

Fixes:
https://autobuild.buildroot.net/results/b0d/b0dbae7b2c884f5fef0017755b28932a83921a5a/
"check/crc32_arm64.h:27:25: fatal error: sys/auxv.h: No such file or directory
   27 | #               include <sys/auxv.h>"

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 2e2d038918)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-15 08:17:35 +02:00
Bernd Kuhls
8f19b5b809 package/leafnode2: fix build without pod2man
Fixes a build error when pod2man is missing on the host:

  pod2man ./tools/lsmac.pl >lsmac.1 || { rm -f lsmac.1 ; false ; }
  /bin/sh: line 1: pod2man: command not found

Fixes:
https://autobuild.buildroot.net/results/999/9996e81429f90f4615755827ac182094d416c467/

Although the build error only occurs since 2026-03-05 it should be
backported to LTS branches because the last change to the buildroot
package dates back to 2024.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit ec62109990)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-10 14:11:27 +02:00
Bernd Kuhls
8c4c363e56 package/sway: needs pcre2 instead of pcre
Buildroot commit 0645cb39e0 bumped the
package from 1.7 to 1.8.1.

Upstream included commit
f614f35e73
in version 1.8 to switch from pcre to pcre2 but the buildroot package
was not updated accordingly.

Pcre2 was already selected by pango -> libglib2 -> pcre2 so this bug was
never noticed.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e8466476c4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-10 14:10:45 +02:00
Bernd Kuhls
874aae2bec package/luvi: update help text
Buildroot commit 00317f0aff switched the
package from pcre to pcre2 but forgot update the Kconfig help text.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 60a95e04d4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-10 14:09:43 +02:00
Bernd Kuhls
cb34aef3f8 package/freeradius-server: remove redundant pcre dependency
Buildroot commit 736c4c1655 added the
package with two identical code blocks dealing with the dependency to
pcre:

https://gitlab.com/buildroot.org/buildroot/-/blob/2026.02/package/freeradius-server/freeradius-server.mk#L161
https://gitlab.com/buildroot.org/buildroot/-/blob/2026.02/package/freeradius-server/freeradius-server.mk#L218

Remove one of these code blocks.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 6c3a015a5e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-10 14:09:27 +02:00
Bernd Kuhls
1125238c9f package/libinput: security bump version to 1.31.1
https://lore.freedesktop.org/wayland-devel/ac3BI2BjKx53LqmH@quokka/T/#u

Fixes CVE-2026-35093 & CVE-2026-35094.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit b9ac6cce07)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-10 14:03:37 +02:00
Giulio Benetti
53cd2b0d0d package/bind: security bump to version 9.18.48
Release notes:
https://ftp.isc.org/isc/bind9/9.18.48/doc/arm/html/notes.html

Changelog:
https://ftp.isc.org/isc/bind9/9.18.48/doc/arm/html/changelog.html

Fixes bugs:
GL #5817
https://gitlab.isc.org/isc-projects/bind9/-/issues/5817
GL #5800
https://gitlab.isc.org/isc-projects/bind9/-/issues/5800
GL #5826
https://gitlab.isc.org/isc-projects/bind9/-/issues/5826

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f42f5f4dbc)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-10 14:02:57 +02:00
Bernd Kuhls
986b66534e package/giflib: security bump version to 6.1.2
https://sourceforge.net/p/giflib/code/ci/6.1.2/tree/NEWS

Patch 0001 was removed because it is included in this release:
dd8b375e2a/

Patch 0002 is not needed anymore because upstream removed gif2rgb from
the list of installable make targets:
35dc68311a/

Updated license hash due to upstream commit
4a425b7348/

The CVEs mentioned in the release notes (CVE-2021-40633 &
CVE-2025-31344) are related to gif2rgb only.

Build-tested using this defconfig:

  BR2_x86_64=y
  BR2_TOOLCHAIN_EXTERNAL=y
  BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
  BR2_PACKAGE_KODI=y
  BR2_PACKAGE_EFL=y
  # BR2_PACKAGE_EFL_EEZE is not set
  # BR2_PACKAGE_EFL_FONTCONFIG is not set
  # BR2_PACKAGE_EFL_GSTREAMER1 is not set
  # BR2_PACKAGE_EFL_LIBFRIBIDI is not set
  # BR2_PACKAGE_EFL_ELPUT is not set
  # BR2_PACKAGE_EFL_LIBSNDFILE is not set
  # BR2_PACKAGE_EFL_PULSEAUDIO is not set
  # BR2_PACKAGE_EFL_UTIL_LINUX_LIBMOUNT is not set
  BR2_PACKAGE_MESA3D=y
  BR2_PACKAGE_MESA3D_GALLIUM_DRIVER_SOFTPIPE=y
  BR2_PACKAGE_MESA3D_OPENGL_EGL=y
  BR2_PACKAGE_MESA3D_OPENGL_ES=y
  BR2_PACKAGE_XORG7=y
  BR2_PACKAGE_LUAJIT=y
  BR2_PACKAGE_OPENJDK=y
  BR2_PACKAGE_PYTHON3=y
  BR2_PACKAGE_PYTHON3_PY_ONLY=y
  BR2_PACKAGE_IMLIB2=y
  BR2_PACKAGE_IMLIB2_GIF=y
  BR2_PACKAGE_LEPTONICA=y
  BR2_PACKAGE_LIBGDIPLUS=y
  BR2_PACKAGE_WEBP=y
  BR2_PACKAGE_DLIB=y
  BR2_PACKAGE_GDAL=y

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 5388405cfd)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-10 14:00:48 +02:00
Bernd Kuhls
20785f51ff package/kodi: allow build with giflib 6.x
These patches fix build errors which would be introduced by the upcoming
bump of giflib to 6.1.2.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 66c12774cf)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-10 14:00:05 +02:00
Bernd Kuhls
82d17ceacb package/giflib: update tarball URL
Upstream moved all tarballs to new locations:
https://sourceforge.net/p/giflib/bugs/190/

Fixes:
https://autobuild.buildroot.net/results/c7f/c7f918fe7c879706c5a5875ea11c5f8b57007a85/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit ea698142bd)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-10 13:59:17 +02:00
Francois Perrad
6b319ddb5f package/perl: security bump to version 5.42.2
fix CVE 2026-4176 : contains a vulnerable version of Compress::Raw::Zlib

For release notes, see:
https://perldoc.perl.org/5.42.2/perl5422delta

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit d690060618)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-10 12:27:05 +02:00
Luca Ceresoli
829b1819fc system: fix typo in comment
Fix "TARTGET_DIR" -> "TARGET_DIR" typo.

Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 20080af519)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-10 12:20:26 +02:00
Daniel Brát
6f8f031cef package/musl: bump to version 1.2.6
For release announce, see:
https://www.openwall.com/lists/musl/2026/03/20/1

For change log, see:
https://git.musl-libc.org/cgit/musl/tree/WHATSNEW?h=v1.2.6#n2444

This upstream relase includes fix for the CVE-2025-26519 and several other
issues buildroot previously needed to apply its own patches for.
Sha256 of the COPYRIGHT file has changed due to a contributor name change,
licence remains otherwise the same. See:
https://git.musl-libc.org/cgit/musl/commit/COPYRIGHT?id=2fc56aaa9f660ebd735d1595c3501b792af42eb8

Signed-off-by: Daniel Brát <danek.brat@gmail.com>
[Julien: add links in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 9018402c2c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-10 12:20:18 +02:00
Titouan Christophe
b98c6b833f package/cpp-httplib: security bump to v0.40.0
See the release notes:

- https://github.com/yhirose/cpp-httplib/releases/tag/v0.38.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.39.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.40.0

Fixes the following vulnerabilities:

- CVE-2026-33745
- CVE-2026-34441

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 774a09423e)
[thomas: mention security bump]
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-10 12:19:10 +02:00
Titouan Christophe
1316869959 package/cpp-httplib: security bump to v0.37.2
See the release notes of intermediate versions:
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.28.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.29.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.30.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.30.1
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.30.2
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.31.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.32.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.33.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.33.1
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.34.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.35.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.36.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.37.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.37.1
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.37.2

This fixes numerous vulnerabilities:

- CVE-2026-21428:
    cpp-httplib is a C++11 single-file header-only cross platform
    HTTP/HTTPS library. Prior to version 0.30.0, the ``write_headers``
    function does not check for CR & LF characters in user supplied
    headers, allowing untrusted header value to escape header lines. This
    vulnerability allows attackers to add extra headers, modify request
    body unexpectedly & trigger an SSRF attack. When combined with a
    server that supports http1.1 pipelining (springboot, python twisted
    etc), this can be used for server side request forgery (SSRF). Version
    0.30.0 fixes this issue.
    https://www.cve.org/CVERecord?id=CVE-2026-21428

- CVE-2026-22776:
    cpp-httplib is a C++11 single-file header-only cross platform
    HTTP/HTTPS library. Prior to version 0.30.1, a Denial of Service (DoS)
    vulnerability exists in cpp-httplib due to the unsafe handling of
    compressed HTTP request bodies (Content-Encoding: gzip, br, etc.). The
    library validates the payload_max_length against the compressed data
    size received from the network, but does not limit the size of the
    decompressed data stored in memory.
    https://www.cve.org/CVERecord?id=CVE-2026-22776

- CVE-2026-28434:
    cpp-httplib is a C++11 single-file header-only cross platform
    HTTP/HTTPS library. Prior to 0.35.0, when a request handler throws a
    C++ exception and the application has not registered a custom
    exception handler via set_exception_handler(), the library catches the
    exception and writes its message directly into the HTTP response as a
    header named EXCEPTION_WHAT. This header is sent to whoever made the
    request, with no authentication check and no special configuration
    required to trigger it. The behavior is on by default. A developer who
    does not know to opt in to set_exception_handler() will ship a server
    that leaks internal exception messages to any client. This
    vulnerability is fixed in 0.35.0.
    https://www.cve.org/CVERecord?id=CVE-2026-28434

- CVE-2026-28435:
    cpp-httplib is a C++11 single-file header-only cross platform
    HTTP/HTTPS library. Prior to 0.35.0, cpp-httplib (httplib.h) does not
    enforce Server::set_payload_max_length() on the decompressed request
    body when using HandlerWithContentReader (streaming ContentReader)
    with Content-Encoding: gzip (or other supported encodings). A small
    compressed payload can expand beyond the configured payload limit and
    be processed by the application, enabling a payload size limit bypass
    and potential denial of service (CPU/memory exhaustion). This
    vulnerability is fixed in 0.35.0.
    https://www.cve.org/CVERecord?id=CVE-2026-28435

- CVE-2026-29076:
    cpp-httplib is a C++11 single-file header-only cross platform
    HTTP/HTTPS library. Prior to version 0.37.0, cpp-httplib uses
    std::regex (libstdc++) to parse RFC 5987 encoded filename* values in
    multipart Content-Disposition headers. The regex engine in libstdc++
    implements backtracking via deep recursion, consuming one stack frame
    per input character. An attacker can send a single HTTP POST request
    with a crafted filename* parameter that causes uncontrolled stack
    growth, resulting in a stack overflow (SIGSEGV) that crashes the
    server process. This issue has been patched in version 0.37.0.
    https://www.cve.org/CVERecord?id=CVE-2026-29076

- CVE-2026-31870:
    cpp-httplib is a C++11 single-file header-only cross platform
    HTTP/HTTPS library. Prior to 0.37.1, when a cpp-httplib client uses
    the streaming API (httplib::stream::Get, httplib::stream::Post, etc.),
    the library calls std::stoull() directly on the Content-Length header
    value received from the server with no input validation and no
    exception handling. std::stoull throws std::invalid_argument for non-
    numeric strings and std::out_of_range for values exceeding ULLONG_MAX.
    Since nothing catches these exceptions, the C++ runtime calls
    std::terminate(), which kills the process with SIGABRT. Any server the
    client connects to — including servers reached via HTTP redirects,
    third-party APIs, or man-in-the-middle positions can crash the client
    application with a single HTTP response. No authentication is
    required. No interaction from the end user is required. The crash is
    deterministic and immediate. This vulnerability is fixed in 0.37.1.
    https://www.cve.org/CVERecord?id=CVE-2026-31870

- CVE-2026-32627:
    cpp-httplib is a C++11 single-file header-only cross platform
    HTTP/HTTPS library. Prior to 0.37.2, when a cpp-httplib client is
    configured with a proxy and set_follow_location(true), any HTTPS
    redirect it follows will have TLS certificate and hostname
    verification silently disabled on the new connection. The client will
    accept any certificate presented by the redirect target — expired,
    self-signed, or forged — without raising an error or notifying the
    application. A network attacker in a position to return a redirect
    response can fully intercept the follow-up HTTPS connection, including
    any credentials or session tokens in flight. This vulnerability is
    fixed in 0.37.2.
    https://www.cve.org/CVERecord?id=CVE-2026-32627

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 8dad17ea06)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-10 12:17:03 +02:00
Petr Vorel
1f3dbbaabb package/ltp-testsuite: Always require host-pkgconf
Require host-pkgconf only for libtirpc is not enough because libmnl
requires as well.

Upstream added it since 20200515 commit
553ca8ea3b ("net/route: Add netlink based route change tests")
using it in m4/ltp-libmnl.m4.

Later, in 20210524 in commit
6e17e2ba13 ("configure: Improve error message on missing pkg-config")
configure.ac required it explicitly:

m4_ifndef([PKG_CHECK_EXISTS],
	[m4_fatal([must install pkg-config or pkgconfig and pkg.m4 macro (usual dependency), see INSTALL])])

This fixes error:
checking pkg-config is at least version 0.9.0... ./configure: line 7419: br-mips64r6-el-hf-glibc/host/bin/pkg-config: No such file or directory

Signed-off-by: Petr Vorel <petr.vorel@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d421a5d278)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-10 11:59:07 +02:00
Thomas Perale
d75c53a758 package/nghttp2: patch CVE-2026-27135
Fixes the following vulnerability:

- CVE-2026-27135:
    nghttp2 is an implementation of the Hypertext Transfer Protocol
    version 2 in C. Prior to version 1.68.1, the nghttp2 library stops
    reading the incoming data when user facing public API
    `nghttp2_session_terminate_session` or
    `nghttp2_session_terminate_session2` is called by the application.
    They might be called internally by the library when it detects the
    situation that is subject to connection error. Due to the missing
    internal state validation, the library keeps reading the rest of the
    data after one of those APIs is called. Then receiving a malformed
    frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2
    v1.68.1 adds missing state validation to avoid assertion failure. No
    known workarounds are available.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2026-27135
  - 5c7df8fa81

(cherry picked from commit 7d26ff6c14)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-10 11:56:10 +02:00
Franciszek Stachura
f3f4ba919e support/testing: add memcached test
Add a basic runtime test for memcached. The test starts memcached and
checks if it responds to a basic set/get request.

Signed-off-by: Franciszek Stachura <fbstachura@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit aa2d71ac38)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-03 11:53:18 +02:00
Shubham Chakraborty
7c26d4e6be DEVELOPERS: add Shubham Chakraborty as ccache maintainer
Signed-off-by: Shubham Chakraborty <chakrabortyshubham66@gmail.com>
[Julien: add trailing slash]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 6bac6a1a63)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-03 11:53:15 +02:00
Peter Korsgaard
bd446d02af package/rauc: security bump to version 1.15.2
Fixes the following security issue:

CVE-2026-34155: Improper Signing of Plain Bundles Exceeding 2 GiB

RAUC bundles using the 'plain' format exceeding a payload size of 2 GiB
cause an integer overflow which results in a signature which covers only the
first few bytes of the payload.  Given such a bundle with a legitimate
signature, an attacker can modify the part of the payload which is not
covered by the signature.

Bundles using the recommended 'verity' or 'crypt' formats are not affected.

For more details, see the advisory:
https://github.com/rauc/rauc/security/advisories/GHSA-6hj7-q844-m2hx

https://github.com/rauc/rauc/releases/tag/v1.15.2

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 6e4a136363)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-03 11:53:13 +02:00
Bernd Kuhls
2745326e6c package/libpng: security bump to version 1.6.56
Fixes the following security vulnerabilities:

CVE-2026-33416 (high):
Use-after-free via pointer aliasing in `png_set_tRNS` and `png_set_PLTE`.

CVE-2026-33636 (high):
Out-of-bounds read/write in the palette expansion on ARM Neon.

For more details, see the advisories:
https://github.com/pnggroup/libpng/security/advisories/GHSA-m4pc-p4q3-4c7j
https://github.com/pnggroup/libpng/security/advisories/GHSA-wjr5-c57x-95m2

Release notes:
https://github.com/pnggroup/libpng/blob/v1.6.56/ANNOUNCE

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 22e4440eae)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-03 11:53:11 +02:00
Bernd Kuhls
6cb5e52b34 package/freetype: security bump version to 2.14.3
https://sourceforge.net/projects/freetype/files/freetype2/2.14.3/
"- A bunch of potential security problems have been found.  All users
 should update."

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit a9a4d0a7a5)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-03 11:53:09 +02:00
Bernd Kuhls
220744c3aa package/tor: security bump version to 0.4.9.6
https://gitlab.torproject.org/tpo/core/tor/-/blob/tor-0.4.9.6/ReleaseNotes

Fixes TROVE-2026-003 & TROVE-2026-004. See:
https://gitlab.torproject.org/tpo/core/team/-/wikis/NetworkTeam/TROVE

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: add link to TROVE page]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f359f665be)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-03 11:53:07 +02:00
Titouan Christophe
6c09a5fee5 SECURITY.md: add new file
This is an in-tree description of Buildroot's security policies

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 0ce674c244)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-03 11:53:05 +02:00
Giulio Benetti
dccfa5b18f package/bind: security bump to version 9.18.47
Release notes:
https://ftp.isc.org/isc/bind9/9.18.47/doc/arm/html/notes.html

Changelog:
https://ftp.isc.org/isc/bind9/9.18.47/doc/arm/html/changelog.html

Fixes CVE-2026-1519.

Fixes bug:
GL #5708
https://gitlab.isc.org/isc-projects/bind9/-/issues/5708

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 0fa55218f4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-03 11:53:03 +02:00
Vincent Stehlé
b185cceaff boot/edk2: fix build with host gcc >= 15, glibc >= 2.43
The edk2 package fails to build with gcc 15, with the following error:

  EfiRom.c:78:17: error: assignment discards 'const' qualifier from pointer target type [-Werror=discarded-qualifiers]

Cherry-pick one patch from edk2-stable202602 to fix this.

This can be verified with the tests.boot.test_edk2 python tests.

Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Cc: Dick Olsson <hi@senzilla.io>
[Julien: add "host" gcc 15 and glibc 2.43 in commit title]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d18f7e0916)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-03 11:53:01 +02:00
Manuel Diener
17920c622e package/python-django: security bump to 6.0.3
Fixes the following security issues:

CVE-2026-25673 (moderate):
Potential denial-of-service vulnerability in URLField via Unicode
normalization on Windows
https://www.cve.org/CVERecord?id=CVE-2026-25673

CVE-2026-25674 (low): Potential incorrect permissions on newly
created file system objects
https://www.cve.org/CVERecord?id=CVE-2026-25674

See the release notes here:
https://docs.djangoproject.com/en/6.0/releases/6.0.3/

This commit also fixes the license hash file
django/contrib/gis/measure.py, after whitespace cleanup:
090f1da56e (diff-eb11d321d233226d88aeffc485fb6c318a06e807feb1574d80a92a7d6a1461a2)

Signed-off-by: Manuel Diener <manuel.diener@oss.othermo.de>
[Julien: fix license hash for django/contrib/gis/measure.py]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit c8dd9e9a01)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-03 11:52:59 +02:00
Waldemar Brodkorb
8b6b54245e DEVELOPERS: remove Waldemar Brodkorb from zabbix
I am no longer interested in zabbix.

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 83386ecb9c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-03 11:52:57 +02:00
Waldemar Brodkorb
03ef4770e4 package/asterisk: security bump to 22.8.2
See here for detailed changelog:
https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-22.8.2.html

Fixes the following CVEs:

CVE-2026-23739 / GHSA-85x7-54wr-vh42:
Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential
XXE Injection
https://github.com/asterisk/asterisk/security/advisories/GHSA-85x7-54wr-vh42
https://www.cve.org/CVERecord?id=CVE-2026-23739

CVE-2026-23741 / GHSA-rvch-3jmx-3jf3:
ast_coredumper running as root sources ast_debug_tools.conf from
/etc/asterisk; potentially leading to privilege escalation
https://github.com/asterisk/asterisk/security/advisories/GHSA-rvch-3jmx-3jf3
https://www.cve.org/CVERecord?id=CVE-2026-23741

CVE-2026-23738 / GHSA-v6hp-wh3r-cwxh:
The Asterisk embedded web server's /httpstatus page echos user
supplied values(cookie and query string) without sanitization
https://github.com/asterisk/asterisk/security/advisories/GHSA-v6hp-wh3r-cwxh
https://www.cve.org/CVERecord?id=CVE-2026-23738

CVE-2026-23740 / GHSA-xpc6-x892-v83c:
ast_coredumper runs as root, and writes gdb init file to world
writeable folder; leading to potential privilege escalation
https://github.com/asterisk/asterisk/security/advisories/GHSA-xpc6-x892-v83c
https://www.cve.org/CVERecord?id=CVE-2026-23740

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
[Julien: add CVE details in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 84ece21e84)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-02 15:28:16 +02:00
Titouan Christophe
731cc7e2a3 {linux, linux-headers}: bump 6.12.x, 6.6.x, 6.1.x, 6.19.x, 6.18.x series
Update the latest kernel releases to:
 - 6.12.77 -> 6.12.79
 - 6.6.129 -> 6.6.130
 - 6.1.166 -> 6.1.167
 - 6.19.9 -> 6.19.10
 - 6.18.19 -> 6.18.20

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2026-03-30 14:41:09 +02:00
Andreas Ziegler
6578fd1729 package/mpd: add missing optional dependency
Config.in selects libiconv in certain situations (uClibc with locales
not enabled). This may lead to a build error with utils/test-pkg -p mpd.

Add missing optional dependency and restore sorting order.

Signed-off-by: Andreas Ziegler <br025@umbiko.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 83e637d7cc)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-26 17:08:05 +01:00
Andreas Ziegler
4712caeeb6 package/mpd: disable build of manuals
The documentation feature was introduced with version 0.22, but is not
used. Instead two other options (also introduced with 0.22) control
building HTML manual and man pages. If the tools needed are not found,
the documentation build finishes silently.

Save Meson some effort by setting both options to 'false'.

Signed-off-by: Andreas Ziegler <br025@umbiko.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e7e2050d54)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-26 17:08:03 +01:00
Andreas Ziegler
557e7816c2 package/mpd: enforce tcp for options using http
Prevent disabling of TCP if some option is selected that uses HTTP.

Fixes:
https://autobuild.buildroot.org/results/59b0be79b1ca1469477e7634205f3eaaebef7d5f

Signed-off-by: Andreas Ziegler <br025@umbiko.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit ee324c5bab)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-26 17:08:01 +01:00
Bernd Kuhls
fdf1bdd0cf package/igh-ethercat: fix build with kernel >= 6.15
Buildroot commit c6e9148197 bumped the
package from 1.6.3 to 1.6.8. The previous version 1.6.3 failed to build
with kernel >= 6.15 as seen here:
https://autobuild.buildroot.net/results/7f4/7f4b3e632a5de67dec2624a2097045ec4d767246/
"examples/mini/mini.c:528:5: error: implicit declaration of function
 'del_timer_sync' [-Wimplicit-function-declaration]
  528 |     del_timer_sync(&timer);"

The bump to 1.6.8 includes a commit which fixes the problem:
240080f110

but it only masked other build errors which were found by the
autobuilders:
https://autobuild.buildroot.net/results/1a5/1a546ee2217e7843b852a5b79b477ef23df6a064/
"examples/tty/tty.c:236:5: error: implicit declaration of function
 'del_timer_sync' [-Wimplicit-function-declaration]
  236 |     del_timer_sync(&timer);"

which need similar fixes.

Fixes:
https://autobuild.buildroot.net/results/0ba/0ba7163e5012309d3a31aa7186ca95a9d5c8de69/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 7fe315a6f7)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-26 17:07:59 +01:00
Bernd Kuhls
b17368f7c1 package/expat: security bump version to 2.7.5
https://github.com/libexpat/libexpat/blob/R_2_7_5/expat/Changes

Fixes CVE-2026-32776, CVE-2026-32777 & CVE-2026-32778.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 763b9c289e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-26 17:07:56 +01:00
Neal Frager
0251ef1466 package/bootgen: fix build issue if host-flex already built
Fix a silent build issue with the host-bootgen package if host-flex is already
built. The host-flex package will install a version of the flexlexer.h header
file that is not compatible with the version embedded in bootgen.

While the build will still 'succeed', the binary will not be correct. This
can be seen by just running the binary that is built. By default, running
bootgen without any parameters should print the help menu, but if the wrong
version of flexlexer.h is used, it will print the following instead:

$ output/host/bin/bootgen

****** Bootgen v2025.1-Merged
  **** Build date : Mar 18 2026-07:08:01
    ** Copyright 1986-2022 Xilinx, Inc. All Rights Reserved.
    ** Copyright 2022-2025 Advanced Micro Devices, Inc. All Rights Reserved.

ERROR: syntax error
-h

Add a patch to the bootgen package that corrects the issue.

Upstream: CR to AMD jira

Signed-off-by: Neal Frager <neal.frager@amd.com>
Tested-by: Steven J. Hill <steven.hill@collins.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 75f62dc669)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-26 17:07:54 +01:00
Vincent Stehlé
4a64ec36cc package/xen: fix armv7 build with gcc-15
Backport a patch from Xen 4.21 to fix the following build errors for Arm v7
with gcc-15:

  xen-4.14.6/xen/include/asm/platforms/midway.h:1: error: header guard '__ASM_ARM_PLATFORMS_MIDWAY_H' followed by '#define' of a different macro [-Werror=header-guard]
  xen-4.14.6/xen/include/asm/platforms/omap5.h:1: error: header guard '__ASM_ARM_PLATFORMS_OMAP5_H' followed by '#define' of a different macro [-Werror=header-guard]

Since the external 32b arm toolchain has been updated to a version based on
gcc-15, the tests.package.test_xen.TestXenArmv7 python test does not build
anymore.
Adding the patch repairs it.

Link: https://gitlab.com/buildroot.org/buildroot/-/jobs/13518318473
Fixes: 86d453a7dc ("toolchain/toolchain-external/toolchain-external-arm-arm: bump to 15.2.rel1")
Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Cc: Alistair Francis <alistair@alistair23.me>
Cc: Dowan Gullient <dowan.gullient@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 0e8739fab2)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-26 17:07:52 +01:00
Manuel Diener
e077238853 DEVELOPERS: add Manuel Diener to several packages
Add myself to packages recently orphaned which I am going to continue.

Signed-off-by: Manuel Diener <manuel.diener@oss.othermo.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit de7bd5034b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-26 17:07:50 +01:00
James Hilliard
955a57bda7 package/wpebackend-fdo: fix EGL_NOT_INITIALIZED crash
Commit 4cd4b2e1e6 updated mesa3d
past version 25.2.0 which deprecated the legacy wayland
EGL_WL_bind_wayland_display interface, as wpebackend-fdo
currently still relies on this functionality ensure that we
enable EGL_WL_bind_wayland_display in mesa3d.

Fixes:
 - https://lore.kernel.org/all/CADvTj4pYf0uymrkZUuWgahWK=pm5CgTJL5U+gwbwKExK1so5jA@mail.gmail.com/

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Acked-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit c897438742)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-26 17:07:48 +01:00
James Hilliard
8061b9f4f7 package/mesa3d: add EGL_WL_bind_wayland_display support
This feature was made optional in mesa3d 25.2.0 as it is deprecated,
however some packages still require it so lets add a new config
option that those packages can select until they no longer require
this feature.

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Reviewed-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit 0260741639)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-26 17:07:46 +01:00
Fabien Lehoussel
6980799e92 support/scripts/generate-cyclonedx: add source attribute to CVEs
Add 'source' attribute to each CVE in vulnerabilities node, including NVD
URL reference to enable proper import into Dependency-Track.

Dependency-Track's VEX importer requires the source attribute to
properly process vulnerability entries. Without it, vulnerabilities are
skipped during import with "does not have an ID and / or source" warnings.

Include the full NVD URL following the CycloneDX 1.6 documentation format:
https://nvd.nist.gov/vuln/detail/{CVE-ID}

Test Environment:
- Buildroot: 2025.02.11 (or master)
- Dependency-Track: v4.13.6

Test Results - BEFORE (without source attribute):
apiserver_1  | 2026-02-23 16:05:40,890 INFO [VexUploadProcessingTask] Processing CycloneDX VEX uploaded to project: e43fe185-c0a3-4e3a-a908-667344a66a9c
apiserver_1  | 2026-02-23 16:05:40,941 WARN [CycloneDXVexImporter] VEX vulnerability at position #0 does not have an ID and / or source; Skipping it
apiserver_1  | 2026-02-23 16:05:40,941 WARN [CycloneDXVexImporter] VEX vulnerability at position #1 does not have an ID and / or source; Skipping it
...
apiserver_1  | 2026-02-23 16:05:40,941 WARN [CycloneDXVexImporter] VEX vulnerability at position #19 does not have an ID and / or source; Skipping it
apiserver_1  | 2026-02-23 16:05:40,941 INFO [CycloneDXVexImporter] The uploaded VEX does not contain any applicable vulnerabilities; Skipping VEX import

Test Results - AFTER (with source):
apiserver_1  | 2026-02-23 16:17:13,492 INFO [VexUploadProcessingTask] Processing CycloneDX VEX uploaded to project: e43fe185-c0a3-4e3a-a908-667344a66a9c
apiserver_1  | 2026-02-23 16:17:14,054 INFO [VexUploadProcessingTask] Completed processing of CycloneDX VEX for project: e43fe185-c0a3-4e3a-a908-667344a66a9c

CVEs are correctly imported in Dependency-Track

Signed-off-by: Fabien Lehoussel <fabien.lehoussel@smile.fr>
Acked-By: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit 3a5e70d1d1)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-26 17:07:43 +01:00
Fabien Lehoussel
2294bcbc27 cve-check: fix CVE URL format
Update NVD source to full URL format following CycloneDC 1.6
specification [1].

Before: "url": "https://nvd.nist.gov/"
After:  "url": "https://nvd.nist.gov/vuln/detail/CVE-XXXX"

[1] https://cyclonedx.org/docs/1.6/json/#vulnerabilities_items_source_url

Signed-off-by: Fabien Lehoussel <fabien.lehoussel@smile.fr>
Acked-By: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit ac466d4b1a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-26 17:07:41 +01:00
Waldemar Brodkorb
a533d160c0 package/uclibc: bump to 1.0.57
Following changes made it into the release:

Joris van Rantwijk (1):
      Fix adjtimex() with TIME64

Waldemar Brodkorb (8):
      sys/stat.h: remove _STAT_VER/_MKNOD_VER
      fix gettid() declaration
      add statx syscall wrapper
      sparc: add optimize build support for leon3
      sparc: sync with Linux kernel definition, fixes gdb compile
      fix compile error on earlier Kernels predating statx
      select: fix compilation failure with very old kernel
      bump version for 1.0.57 release

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 84bc50c82d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-26 17:07:39 +01:00
Julien Olivain
75c2df66f6 package/zfs: add patch to fix build with uclibc >= 1.0.57
uclibc 1.0.57 added a statx() syscall wrapper in upstream commit [1].

zfs fail to build with uclibc 1.0.57 (not yet in Buildroot), because:
1. uclibc <fcntl.h> internally includes <sys/stat.h>, and
2. a zfs test redefines a statx() wrapper with a slightly different
   prototype.

In that case, zfs fails to compile with error:

    tests/zfs-tests/cmd/statx.c:58:1: error: conflicting types for 'statx'; have 'int(int,  const char *, int,  unsigned int,  void *)'

Issue has been reported upstream at [2].

This commit adds a package patch to fix that issue.

[1] d3a819aff2
[2] https://github.com/openzfs/zfs/pull/18316

Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit b6884913ae)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-26 17:07:37 +01:00
Bernd Kuhls
efc22bcd2c package/python-wheel: security bump version to 0.46.3
https://github.com/pypa/wheel/blob/0.46.3/docs/news.rst

Version 0.46.2 fixes CVE-2026-24049:
wheel Allows Arbitrary File Permission Modification via Path Traversal

Fixes:
https://www.cve.org/CVERecord?id=CVE-2026-24049

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: mark the commit as "security" and add info in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 635c145c16)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-26 17:07:35 +01:00
Bernd Kuhls
89a8b82195 package/python-tornado: security bump version to 6.5.5
https://github.com/tornadoweb/tornado/blob/v6.5.5/docs/releases/v6.5.5.rst

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e59cc42d2f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-26 17:07:32 +01:00
Titouan Christophe
c68605456a {linux, linux-headers}: bump 6.19.x, 6.18.x series
Update the latest kernel releases to:
 - 6.19.8 -> 6.19.9
 - 6.18.18 -> 6.18.19

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2026-03-23 11:26:05 +01:00
Bernd Kuhls
7a454d52bd package/python-pyjwt: security bump version to 2.12.1
https://github.com/jpadilla/pyjwt/blob/2.12.1/CHANGELOG.rst

Fixes CVE-2026-32597:
https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 7c5d57fe82)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:56:35 +01:00
Bernd Kuhls
548a063cbb package/python-pyasn1: security bump version to 0.6.2
https://github.com/pyasn1/pyasn1/blob/v0.6.2/CHANGES.rst

Fixes CVE-2026-23490: https://nvd.nist.gov/vuln/detail/CVE-2026-23490

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 517cdc8e13)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:56:33 +01:00
Bernd Kuhls
aae6fb35a0 package/python-flask: security bump version to 3.1.3
https://github.com/pallets/flask/blob/3.1.3/CHANGES.rst

Fixes CVE-2026-27205: https://nvd.nist.gov/vuln/detail/CVE-2026-27205

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 52f46b24ef)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:56:31 +01:00
Bernd Kuhls
588d37a500 package/sqlite: bump version to 3.51.3
https://sqlite.org/releaselog/3_51_3.html

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 171d4d489c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:56:29 +01:00
Bernd Kuhls
0caae05a2a package/libxml2: security bump version to 2.15.2
Release notes:
https://download.gnome.org/sources/libxml2/2.15/libxml2-2.15.2.news

- CVE-2026-1757 fix: Memory leak in xmllint Shell - shell.c
- CVE-2026-0990 fix: Prevent infinite recursion in
  xmlCatalogListXMLResolve
- CVE-2026-0992 fix: Exponential behavior when handling
- parser: Fix infinite loop in xmlCtxtParseContent
- CVE-2025-10911 libxslt related: Ignore next/prev of documents when
  traversing XPath
- CVE-2026-0989 fix: Add RelaxNG include limit

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 4d4dc5f542)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:56:26 +01:00
Julien Olivain
87d2b48dec support/testing: test_xfsprogs: use bootlin toolchain, update kernel
This commit updates the test configuration to switch to a Bootlin
external toolchain. This is needed to get newer toolchain kernel
headers required by newer xfsprogs versions.

xfsprogs upstream commit [1] (included in v6.15) introduced a usage
of the "capacity" field of zoned block devices, introduced in Kernel
commit [2], first included in v5.9.

This commit also updates the runtime test Kernel version
to the LTS 6.18.18. This is because the default filesystem options
of mkfs.xfs were updated in upstream commit [3] to include new
features supported in the new Kernel 6.18.y LTS series. The commit [3]
is included in xfsprogs v6.18.

[1] https://git.kernel.org/pub/scm/fs/xfs/xfsprogs-dev.git/commit/?id=48ccc2459039309cfbaf358febea53a86f07827c
[2] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=82394db7383d33641f3f565bd79792fb41b1741f
[3] https://git.kernel.org/pub/scm/fs/xfs/xfsprogs-dev.git/commit/?id=54aad16b4b9b923442b4042afaba4438ca1aa868

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit c03712d8ec)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:56:24 +01:00
Neal Frager
d31d4f2b69 board/versal2/post-image.sh: remove incorrect $BINARIES_DIR
Remove incorrect $BINARIES_DIR reference from the symbolic link creation to
make a relative path and not an absolute path.

Signed-off-by: Neal Frager <neal.frager@amd.com>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit 1d603b78c0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:56:22 +01:00
Thomas Richard
e5f300a871 board/stmicroelectronics/stm32mp135f-dk: fix silent crash in U-Boot
Backport upstream patches to fix a silent crash in U-Boot on
STM32MP135F-DK.

Fixes:

  799d184e89

Signed-off-by: Thomas Richard <thomas.richard@bootlin.com>
[Romain: add Fixes link]
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit 5af624386e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:56:20 +01:00
Yann E. MORIN
667111a94d docs/manual: use space-separated list for BR2_EXTERNAL
Specifying a list of br2-external trees is poorly documented, and the
only example uses a colon to separate the br2-external paths.

Adding the support for colon-separated list is the biggest mistake that
was made when introducing support for multiple br2-external [0]. Indeed,
both space and colon can be used to separate entries in the list, and it
is also possible to mix the two. However, internally, the list is stored
as a space-separated list, and all the code will split on spaces.

Besides, all other lists in Buildroot are a space-separated:
    BR2_ROOTFS_DEVICE_TABLE
    BR2_ROOTFS_STATIC_DEVICE_TABLE
    BR2_TARGET_TZ_ZONELIST
    BR2_ROOTFS_USERS_TABLES
    BR2_ROOTFS_OVERLAY
    BR2_ROOTFS_PRE_BUILD_SCRIPT
    BR2_ROOTFS_POST_BUILD_SCRIPT
    BR2_ROOTFS_POST_FAKEROOT_SCRIPT
    BR2_ROOTFS_POST_IMAGE_SCRIPT
    ...

So, using colons is odd.

The fact that BR2_EXTERNAL is passed on the command line rather than
being a Kconfig item is not a reason enough to justify that it be
colon-separated.

Change the documentation to only mention using a space-separated list.

Of course, for backward compatibility, we keep the code as-is to accept
a colon-separated list, but we just do not advertise it.

Note that keeping the split on colons means that colons are not accepted
in pathnames of br2-external trees; in practice, this is not a new
restriction, or one that could lift as usign colons in Makefiles are
problematic anyway.

[0] in 20cd497387 core: add support for multiple br2-external trees

Reported-by: Fiona Klute (WIWA) <fiona.klute@gmx.de>
Reported-by: Brandon Maier <Brandon.Maier@collins.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit f9cdca48a5)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:56:18 +01:00
Yann E. MORIN
b7aa889e19 support/br2-external: fix remaining shellcheck errors
Boring changes: either do what shellcheck suggested, or comment why we
don't want to fix the code.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit 72e068001b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:56:15 +01:00
Yann E. MORIN
846bd9b002 support/br2-external: remove leftover trap
The trap was initially introduced in c5fa9308ea (core/br2-external:
properly report unexpected errors), in 2017, to catch all unexpected
errors, back when a single file was generated, and errors emitted to
stderr.

Since commit d027cd75d0 (core: generate all br2-external files in
one go), in 2019 the single output file 'ofile' is no longer created,
as multiple output files were then introduced, while messages for
*expected errors* were redirected to a Makefile variable assignment
emitted on stdout, at which point the script just exits (in error);
expected failures only occur in do_validate().

Unexpected errors can only occur on failure to create, or write to,
output files, either '.br2-external.mk' in do_validate() or do_mk(),
or any of the kconfig fragments in do_kconfig(). Cause for failure to
create those can only be a no-space-left-on-device condition, as they
are created in a directory that was just created by the script earlier
in main(), and thus has the necessary mode; failure to create that
directory is now caught explicitly.

A trap on ERR is not called when the shell exits explicitly with a call
to 'exit', thus, only failures to create or write to output file would
be caught. In that case, we are better off not trying to write to those
files anyway: failure to create the file would already be reported by
the shell on stderr, while disk-full would not allow to store the output
anyway...

In any case, the script exits in error, which is going to be caught by
the caller, which will terminate.

So, drop the trap altogether.

As a side effect, that squelches a shellcheck error.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit 244e4283a9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:56:13 +01:00
Bernd Kuhls
3447410977 package/php: bump version to 8.5.4
https://www.php.net/ChangeLog-8.php#8.5.4
https://news-web.php.net/php.announce/486

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 712e3e10cf)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:56:11 +01:00
Bernd Kuhls
8ccf7b3887 package/libarchive: security bump version to 3.8.6
https://github.com/libarchive/libarchive/releases/tag/v3.8.6
"Libarchive 3.8.6 is a security and bugfix release."

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d950ff2488)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:56:09 +01:00
Bernd Kuhls
cfb1f63448 package/libcurl: security bump to version 8.19.0
https://curl.se/ch/8.19.0.html
https://curl.se/docs/security.html

Fixes the following CVEs:

CVE-2026-3805: use after free in SMB connection reuse
CVE-2026-3784: wrong proxy connection reuse with credentials
CVE-2026-3783: token leak with redirect and netrc
CVE-2026-1965: bad reuse of HTTP Negotiate connection

Switch to sha256 tarball hash provided by upstream.

Updated license hash due to copyright year bump:
e83c82f05f

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: add back pgp signature info in hash file]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 3a5e071e4f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:56:07 +01:00
Christian Stewart
cab7c3734e package/go: security bump to version 1.26.1
Building Go 1.26 and later requires Go 1.24.6 or later for bootstrap.

To support this we use Go version 1.25.8 as the version for
go-bootstrap-stage5 and have the build for Go 1.26.1 depend on
go-bootstrap-stage5.

Go version 1.25.8 is the latest Go version we can build using
go-bootstrap-stage4.

The package build for go-bootstrap-stage5 is effectively identical to
go-bootstrap-stage4 with only the Go version and stage number changed.

Go 1.28 is expected to require a minor release of Go 1.26 for bootstrap.

Fixes the following security vulnerabilities:

- CVE-2026-25679: net/url: reject IPv6 literal not at start of host
- CVE-2026-27142: html/template: URLs in meta attribute actions not escaped
- CVE-2026-27137: crypto/x509: incorrect enforcement of email constraints
- CVE-2026-27138: crypto/x509: panic in name constraint checking: certificates
- CVE-2026-27139: os: FileInfo can escape from a Root

For full release notes, see:
https://go.dev/doc/devel/release#go1.26.0

Signed-off-by: Christian Stewart <christian@aperture.us>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 43d1323196)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:56:05 +01:00
Julien Olivain
629bdb457b configs/aarch64_efi: switch to external toolchain
This commit switches the aarch64_efi_defconfig to an external glibc
stable Bootlin toolchain, to follow recommendation from [1].

Since an external toolchain is used, the linux-headers.hash custom
hash file is no longer needed and is removed.

[1] https://elinux.org/Buildroot:DeveloperDaysELCE2024#Rules_for_defconfigs

Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 18b8544235)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:56:03 +01:00
Julien Olivain
d9824ad5d9 support/testing: test_connman: new runtime test
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e55952b173)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:56:01 +01:00
Romain Naour
ea69fbb1ad boot/uboot: improve U-Boot OP-TEE TEE format options help text
OP-TEE generates a few binaries that can be used by u-boot on some
platforms (Rockchip, Texas Instruments K3) using TEE variable.

Add a link to the OP-TEE documentation were we can find easily the
desciption for each TEE format that can be used by u-boot.

For convenience, copy tee.elf and tee.bin description in each option
choice help text.

Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit a5f5c08dcd)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:55:59 +01:00
Marcus Hoffmann
8bdf79c098 DEVELOPERS: remove Marcus Hoffmann from no longer used packages
Remove myself from packages that I'm no longer personally interested in.

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 1210e4efeb)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:55:57 +01:00
Giulio Benetti
47e01beb12 package/nfs-utils: security bump version to 2.8.6
Release announce:
https://lore.kernel.org/linux-nfs/4d58bf28-a3e0-4496-bae8-05387da27054@redhat.com/

This update fixes:
https://www.cve.org/CVERecord?id=CVE-2025-12801

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 7dfd2feb44)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:55:55 +01:00
Giulio Benetti
1f053b6b85 package/nfs-utils: bump version to 2.8.5
Release announce:
https://lore.kernel.org/linux-nfs/fdf3631f-e924-4e4c-bd9f-db5b40a90bfe@redhat.com/

With patch [1] option nfsv41 required to be renamed to blkmapd.

[1]: https://git.linux-nfs.org/?p=steved/nfs-utils.git;a=commit;h=59e85671e59f7ccbf66dcf72ce7462bf4932cc78

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Reviewed-by: Petr Vorel <petr.vorel@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e7928fef42)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:55:53 +01:00
Titouan Christophe
44ba95ab09 {linux, linux-headers}: bump 6.12.x, 6.6.x, 6.1.x, 5.15.x, 5.10.x, 6.19.x, 6.18.x series
Update the latest kernel releases to:
 - 6.12.74 -> 6.12.77
 - 6.6.127 -> 6.6.129
 - 6.1.164 -> 6.1.166
 - 5.15.201 -> 5.15.202
 - 5.10.251 -> 5.10.252
 - 6.19.5 -> 6.19.8
 - 6.18.15 -> 6.18.18

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2026-03-16 15:13:51 +01:00
Bernd Kuhls
a6a9c1930e package/jasper: fix build without threads
Buildroot commit 03a1732dea bumped the
package from 2.0.33 to 4.2.8. This bump includes upstream commit
91fca09209
which was added to version 3.0.0 and causes build errors when threads
are not available:

    message(FATAL_ERROR "Threading support is not available.")

because JAS_ENABLE_MULTITHREADING_SUPPORT defaults to ON:
https://github.com/jasper-software/jasper/blob/version-4.2.8/CMakeLists.txt#L124

Add configure options to disable thread support when needed.

Fixes:
https://autobuild.buildroot.net/results/870/870d6adbac166b22cce217628d477b1bce538320/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d32b12b548)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:22:02 +01:00
Bernd Kuhls
d8dc041795 package/libheif: needs gcc >= 10
Fixes build error with gcc 9.x:

output/build/libheif-1.21.1/libheif/nclx.h:128:50: error:
 'bool nclx_profile::operator==(const nclx_profile&)
 const' cannot be defaulted

 using this defconfig:

  BR2_arm=y
  BR2_TOOLCHAIN_EXTERNAL=y
  BR2_TOOLCHAIN_EXTERNAL_CUSTOM=y
  BR2_TOOLCHAIN_EXTERNAL_DOWNLOAD=y
  BR2_TOOLCHAIN_EXTERNAL_URL="http://autobuild.buildroot.org/toolchains/tarballs/br-arm-full-static-2020.11.2.tar.bz2"
  BR2_TOOLCHAIN_EXTERNAL_GCC_9=y
  BR2_TOOLCHAIN_EXTERNAL_HEADERS_4_4=y
  BR2_TOOLCHAIN_EXTERNAL_LOCALE=y
  # BR2_TOOLCHAIN_EXTERNAL_HAS_THREADS_DEBUG is not set
  BR2_TOOLCHAIN_EXTERNAL_CXX=y
  BR2_STATIC_LIBS=y
  BR2_PACKAGE_LIBHEIF=y

According to https://github.com/strukturag/libheif/issues/1615#issuecomment-3457979167
gcc >= 10 with support for C++20 is needed for the package.

The failing code was introduced upstream in version 0.21.0 with commit
a62f933e38
which was added to buildroot with commit
a8aed698c7.

Also removed -std=c++11 from CXXFLAGS.

The build error was not yet recorded by the autobuilders.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 7323bcc1d4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:21:17 +01:00
Bernd Kuhls
9c2ea8a463 package/libvips: fix static build
Buildroot commit 72c7d99e22 switched the
build system to meson which causes an error during configure:

output/build/libvips-8.17.2/meson.build:108:4:
 ERROR: Problem encountered: GModule is not supported on your system,
 please reconfigure with -Dmodules=disabled

using this defconfig:

  BR2_arm=y
  BR2_TOOLCHAIN_EXTERNAL=y
  BR2_TOOLCHAIN_EXTERNAL_CUSTOM=y
  BR2_TOOLCHAIN_EXTERNAL_DOWNLOAD=y
  BR2_TOOLCHAIN_EXTERNAL_URL="http://autobuild.buildroot.org/toolchains/tarballs/br-arm-full-static-2020.11.2.tar.bz2"
  BR2_TOOLCHAIN_EXTERNAL_GCC_9=y
  BR2_TOOLCHAIN_EXTERNAL_HEADERS_4_4=y
  BR2_TOOLCHAIN_EXTERNAL_LOCALE=y
  # BR2_TOOLCHAIN_EXTERNAL_HAS_THREADS_DEBUG is not set
  BR2_TOOLCHAIN_EXTERNAL_CXX=y
  BR2_STATIC_LIBS=y
  BR2_PACKAGE_LIBVIPS=y

Added configure options for -Dmodules to fix the problem which was not
yet caught by the autobuilders.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 86d0fcd77b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:17:19 +01:00
Shubham Chakraborty
40f1d20242 package/python3: remove nis and ossaudiodev modules
These modules were dropped in Python 3.13 as per PEP 594.
The current version in Buildroot is 3.14.3.

- Remove the TODO and related config overrides in python3.mk.
- Remove BR2_PACKAGE_PYTHON3_OSSAUDIODEV from Config.in.
- Add BR2_PACKAGE_PYTHON3_OSSAUDIODEV to Config.in.legacy.

See [1] [2] [3].

[1] https://peps.python.org/pep-0594/
[2] fc07fe4e37
[3] 17e1fe0f9b

Signed-off-by: Shubham Chakraborty <chakrabortyshubham66@gmail.com>
[Julien:
 - add links in commit log
 - move legacy option in 2026.05 section
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit df6e7a6664)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:16:11 +01:00
Bernd Kuhls
a3fa3e9cd7 package/faketime: fix host build with glibc 2.43
Fixes:
https://autobuild.buildroot.net/results/911/9112933e2560b155a9c61f321874ec245b62b2a5/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 088c3602fd)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:11:29 +01:00
Bernd Kuhls
254712b12a package/docker: Fix build with gcc-15.x
Add patch from Debian to fix build error with gcc-15.x

Fixes:
https://autobuild.buildroot.net/results/495/4956555fd033d43c1877e66141789bcd06aff5be/

Patch sent to fork which is used by Arch Linux:
https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=wmdocker

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit cc3647e73f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:11:04 +01:00
Bernd Kuhls
70302f9267 package/postgresql: bump version to 18.3
https://www.postgresql.org/about/news/postgresql-183-179-1613-1517-and-1422-released-3246/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Reviewed-by: Maxim Kochetkov <fido_max@inbox.ru>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d62b605c1a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:10:17 +01:00
Bernd Kuhls
bbbad699ae DEVELOPERS: remove Bernd Kuhls from libldns
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 156e2be96c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:09:57 +01:00
Dowan Gullient
4e594d0eda support/testing/infra: update artifacts URL to https and .org domain
The artifacts URL has been moved to https and domain to .org to
improve security and avoid redirection issues. This ensures that
downloads of kernels and rootfs images during runtime tests are
encrypted and verified.

The change has been tested by running a runtime test, confirming the
correct download and renaming of artifacts from the new URL:

    Downloading to .../tmpyotq8uor
    Renaming from .../tmpyotq8uor to .../kernel-versatile-5.10.202

Signed-off-by: Dowan Gullient <dowan.gullient@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 8313d8a2fa)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:06:47 +01:00
Bernd Kuhls
3bfce36750 package/libtpms: security bump version to 0.10.2
https://github.com/stefanberger/libtpms/blob/v0.10.2/CHANGES

Fixes CVE-2026-21444.

Added comment to hash file about locally computed hashes.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit b1c4276c2d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:04:46 +01:00
Bernd Kuhls
60d110ac8d package/libtpms: fix build with host gcc >= 15.x, glibc >= 2.43
Fixes:
https://autobuild.buildroot.net/results/7a6/7a6ea7c513e8f1dcc32d868108bfb2a907d6fe85/

The previous change to src/tpm_library.c dates back to 2024:
https://github.com/stefanberger/libtpms/commits/master/src/tpm_library.c
so a backport to buildroot LTS branches should be considered.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: reword title to mention glibc 2.43]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f773fd6787)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:03:42 +01:00
Julien Olivain
b2dedc5541 support/testing: boot/test_grub: remove 32bit EFI test
EDK2 removed OVMF IA32 support in commit [1], which is included in
version edk2-stable202511. This commit removes the test relying on it.

[1] 1fb88ffe28

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit bd06eace37)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:03:16 +01:00
Julien Olivain
d0d88a9d47 support/testing: fs/test_iso9660: remove 32bit EFI tests
EDK2 removed OVMF IA32 support in commit [1], which is included in
version edk2-stable202511. This commit removes tests relying on it.

[1] 1fb88ffe28

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit cf16e1abe0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:02:53 +01:00
Bernd Kuhls
9f755efa4b package/clamav: security bump version to 1.5.2
https://blog.clamav.net/2026/03/clamav-152-and-144-security-patch.html

Fixes CVE-2026-20031: https://www.cve.org/CVERecord?id=CVE-2026-20031

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d225a6ffad)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:02:24 +01:00
Bernd Kuhls
47addd38d2 package/exiv2: security bump version to 0.28.8
https://exiv2.org/whatsnew.html
https://github.com/Exiv2/exiv2/blob/v0.28.8/doc/ChangeLog

This release fixes three low-severity vulnerabilities:

CVE-2026-25884: Out-of-bounds read in CrwMap::decode0x0805
CVE-2026-27596: Integer overflow in LoaderNative::getData() causes out-of-bounds read
CVE-2026-27631: Uncaught exception: cannot create std::vector larger than max_size()

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 1c3aa5f977)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:01:53 +01:00
Bernd Kuhls
69c4221f25 package/freetype: security bump version to 2.14.2
Release notes:
https://sourceforge.net/projects/freetype/files/freetype2/2.14.2/

Fixes CVE-2026-23865: https://seclists.org/oss-sec/2026/q1/253

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 6c3933d14b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:01:05 +01:00
Adrian Perez de Castro
2ea2018960 package/libsoup3: security bump to 3.6.6
While there is only one CVE number assigned (CVE-2025-14523) for one of
the patches included in this release, the bulk of the the changes are
security fixes.

Release notes may be found at:

  25eac15300

Fixes:
https://www.cve.org/CVERecord?id=CVE-2025-14523

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 1a9998e511)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:00:36 +01:00
2696 changed files with 30511 additions and 28172 deletions

View File

@@ -52,6 +52,7 @@ board/stmicroelectronics/stm32f429-disco/flash.sh Shellcheck
board/stmicroelectronics/stm32f469-disco/flash_sd.sh Shellcheck
board/stmicroelectronics/stm32f469-disco/flash_xip.sh Shellcheck
board/synopsys/axs10x/post-build.sh Shellcheck
board/technologic/ts4900/post-image.sh Shellcheck
board/udoo/common/post-build.sh Shellcheck
boot/afboot-stm32/0003-Makefile-disable-stack-protector.patch lib_patch.Upstream
boot/optee-os/3.13.0/0001-core-zlib-fix-build-warning-when-_LFS64_LARGEFILE-is.patch lib_patch.Upstream
@@ -69,7 +70,9 @@ boot/syslinux/0013-Fix-build-with-gnu-efi-version-3.0.9.patch lib_patch.Upstream
boot/syslinux/0014-Fix-build-with-binutils-note-gnu-property-section.patch lib_patch.Upstream
boot/syslinux/0016-Workaround-multiple-definition-of-symbol-errors.patch lib_patch.Upstream
boot/syslinux/0017-Replace-builtin-strlen-that-appears-to-get-optimized.patch lib_patch.Upstream
configs/am574x_idk_defconfig lib_defconfig.ForceCheckHash
configs/arcturus_ucls1012a_defconfig lib_defconfig.ForceCheckHash
configs/arcturus_ucp1020_defconfig lib_defconfig.ForceCheckHash
configs/asus_tinker-s_rk3288_defconfig lib_defconfig.ForceCheckHash
configs/atmel_sama5d27_som1_ek_mmc_dev_defconfig lib_defconfig.ForceCheckHash
configs/atmel_sama5d2_xplained_mmc_defconfig lib_defconfig.ForceCheckHash
@@ -91,6 +94,7 @@ configs/ci20_defconfig lib_defconfig.ForceCheckHash
configs/freescale_p1025twr_defconfig lib_defconfig.ForceCheckHash
configs/freescale_t1040d4rdb_defconfig lib_defconfig.ForceCheckHash
configs/freescale_t2080_qds_rdb_defconfig lib_defconfig.ForceCheckHash
configs/friendlyarm_nanopi_r2s_defconfig lib_defconfig.ForceCheckHash
configs/globalscale_espressobin_defconfig lib_defconfig.ForceCheckHash
configs/imx23evk_defconfig lib_defconfig.ForceCheckHash
configs/imx6-sabreauto_defconfig lib_defconfig.ForceCheckHash
@@ -99,10 +103,13 @@ configs/imx6-sabresd_qt5_defconfig lib_defconfig.ForceCheckHash
configs/imx6slevk_defconfig lib_defconfig.ForceCheckHash
configs/imx6sx-sdb_defconfig lib_defconfig.ForceCheckHash
configs/imx6ulevk_defconfig lib_defconfig.ForceCheckHash
configs/imx6ullevk_defconfig lib_defconfig.ForceCheckHash
configs/imx6ulpico_defconfig lib_defconfig.ForceCheckHash
configs/imx7dpico_defconfig lib_defconfig.ForceCheckHash
configs/imx8mqevk_defconfig lib_defconfig.ForceCheckHash
configs/khadas_vim3_defconfig lib_defconfig.ForceCheckHash
configs/kontron_bl_imx8mm_defconfig lib_defconfig.ForceCheckHash
configs/kontron_smarc_sal28_defconfig lib_defconfig.ForceCheckHash
configs/mender_x86_64_efi_defconfig lib_defconfig.ForceCheckHash
configs/microchip_sam9x60ek_mmc_defconfig lib_defconfig.ForceCheckHash
configs/microchip_sam9x60ek_mmc_dev_defconfig lib_defconfig.ForceCheckHash
@@ -128,6 +135,9 @@ configs/olpc_xo175_defconfig lib_defconfig.ForceCheckHash
configs/olpc_xo1_defconfig lib_defconfig.ForceCheckHash
configs/orangepi_pc2_defconfig lib_defconfig.ForceCheckHash
configs/orangepi_zero_plus_defconfig lib_defconfig.ForceCheckHash
configs/pine64_defconfig lib_defconfig.ForceCheckHash
configs/pine64_pinecube_defconfig lib_defconfig.ForceCheckHash
configs/s6lx9_microboard_defconfig lib_defconfig.ForceCheckHash
configs/sipeed_lichee_rv_defconfig lib_defconfig.ForceCheckHash
configs/sipeed_lichee_rv_dock_defconfig lib_defconfig.ForceCheckHash
configs/sipeed_licheepi_nano_defconfig lib_defconfig.ForceCheckHash
@@ -148,6 +158,8 @@ configs/solidrun_clearfog_gt_8k_defconfig lib_defconfig.ForceCheckHash
configs/solidrun_macchiatobin_defconfig lib_defconfig.ForceCheckHash
configs/stm32mp157c_odyssey_defconfig lib_defconfig.ForceCheckHash
configs/terasic_de10nano_cyclone5_defconfig lib_defconfig.ForceCheckHash
configs/ts4900_defconfig lib_defconfig.ForceCheckHash
configs/ts5500_defconfig lib_defconfig.ForceCheckHash
configs/uevm5432_defconfig lib_defconfig.ForceCheckHash
configs/visionfive_defconfig lib_defconfig.ForceCheckHash
configs/wandboard_defconfig lib_defconfig.ForceCheckHash
@@ -185,6 +197,7 @@ package/at/0001-Makefile.in-fix-make-install-for-non-root-don-t-stri.patch lib_p
package/at/S99at lib_sysv.Indent lib_sysv.Variables
package/attr/0001-build-with-older-GCCs.patch lib_patch.Upstream
package/aumix/0001-fix-incorrect-makefile-am.patch lib_patch.Upstream
package/autoconf/0001-dont-add-dirty-to-version.patch lib_patch.Upstream
package/automake/0001-noman.patch lib_patch.Upstream
package/avahi/S05avahi-setup.sh lib_sysv.Indent lib_sysv.Variables
package/avahi/S50avahi-daemon lib_sysv.Indent lib_sysv.Variables
@@ -234,6 +247,7 @@ package/cfm/S65cfm lib_sysv.Indent lib_sysv.Variables
package/cgroupfs-mount/S30cgroupfs Shellcheck lib_sysv.Indent lib_sysv.Variables
package/chipmunk/0001-Fix-build-failure-on-musl.patch lib_patch.Upstream
package/chrony/S49chronyd lib_sysv.Variables
package/cmake/0001-rename-cmake-rootfile.patch lib_patch.Upstream
package/collectd/0001-src-netlink.c-remove-REG_NOERROR.patch lib_patch.Upstream
package/connman/S45connman lib_sysv.Variables
package/copas/0001-Do-not-load-coxpcall-for-LuaJIT.patch lib_patch.Upstream
@@ -261,6 +275,8 @@ package/dahdi-tools/0002-no-perl-manpages.patch lib_patch.Upstream
package/dante/0001-fix-sparc-compile.patch lib_patch.Upstream
package/dante/0002-osdep-m4-Remove-getaddrinfo-too-low-checks.patch lib_patch.Upstream
package/dante/S50dante Shellcheck lib_sysv.Indent lib_sysv.Variables
package/daq/0001-Fix-build-against-the-musl-C-library.patch lib_patch.Upstream
package/daq/0002-parallel-grammar.patch lib_patch.Upstream
package/darkhttpd/S50darkhttpd Shellcheck lib_sysv.Indent lib_sysv.Variables
package/davfs2/0001-src-Makefile.am-do-not-hardcode-fstack-protector-str.patch lib_patch.Upstream
package/dbus-cpp/0001-gcc4.7.patch lib_patch.Upstream
@@ -282,6 +298,7 @@ package/dmalloc/0005-configure-use-LD-instead-of-hard-coding-ld.patch lib_patch.
package/docopt-cpp/0001-only-build-one-target-use-BUILD_SHARED_LIBS-where-appropriate.patch lib_patch.Upstream
package/domoticz/S99domoticz Shellcheck
package/dovecot/0001-auth-Fix-handling-passdbs-with-identical-driver-args.patch lib_patch.Upstream
package/dracut/0001-dracut.sh-don-t-unset-LD_PRELOAD.patch lib_patch.Upstream
package/dracut/merged-usr-module-setup.sh Shellcheck
package/dropbear/S50dropbear Shellcheck lib_sysv.Indent lib_sysv.Variables
package/dt/0001-adjust-os-symlink.patch lib_patch.Upstream
@@ -340,18 +357,29 @@ package/freescale-imx/imx-uuc/S80imx-uuc Shellcheck lib_sysv.Indent lib_sysv.Var
package/freescale-imx/imx-vpu-hantro/0001-Fix-ion.h-header-inclusion-to-be-standard.patch lib_patch.Upstream
package/freescale-imx/imx-vpu-hantro/0002-Fix-build-with-uclibc-toolchain.patch lib_patch.Upstream
package/freescale-imx/imx-vpu-hantro/0003-Fix-Linux-kernel-version-header.patch lib_patch.Upstream
package/freeswitch/0001-libs-srtp-crypto-hash-hmac_ossl.c-fix-build-with-lib.patch lib_patch.Upstream
package/frr/S50frr Shellcheck
package/fstrcmp/0001-disable-rpath.patch lib_patch.Upstream
package/ftop/0001-overflow.patch lib_patch.Upstream
package/fwts/0001-build-do-not-use-Werror.patch lib_patch.Upstream
package/fxdiv/0001-CMake-don-t-enable-CXX-unless-building-tests-benchma.patch lib_patch.Upstream
package/fxload/0001-fix-static-build.patch lib_patch.Upstream
package/gcc/14.4.0/0001-disable-split-stack-for-non-thread-builds.patch lib_patch.Upstream
package/gcc/15.3.0/0001-disable-split-stack-for-non-thread-builds.patch lib_patch.Upstream
package/gcc/16.2.0/0001-disable-split-stack-for-non-thread-builds.patch lib_patch.Upstream
package/gcc/13.4.0/0001-disable-split-stack-for-non-thread-builds.patch lib_patch.Upstream
package/gcc/14.3.0/0001-disable-split-stack-for-non-thread-builds.patch lib_patch.Upstream
package/gcc/15.2.0/0001-disable-split-stack-for-non-thread-builds.patch lib_patch.Upstream
package/gcc/8.4.0/0001-xtensa-fix-PR-target-91880.patch lib_patch.Upstream
package/gcc/8.4.0/0002-Revert-re-PR-target-92095-internal-error-with-O1-mcp.patch lib_patch.Upstream
package/gcc/8.4.0/0003-libsanitizer-Remove-cyclades-from-libsanitizer.patch lib_patch.Upstream
package/gcc/8.4.0/0004-disable-split-stack-for-non-thread-builds.patch lib_patch.Upstream
package/gdb/14.2/0001-ppc-ptrace-Define-pt_regs-uapi_pt_regs-on-GLIBC-syst.patch lib_patch.Upstream
package/gdb/14.2/0002-sh-ptrace-Define-pt_-dsp-regs-uapi_pt_-dsp-regs-on-G.patch lib_patch.Upstream
package/gdb/14.2/0003-use-asm-sgidefs.h.patch lib_patch.Upstream
package/gdb/14.2/0004-gdbserver-fix-build-for-m68k.patch lib_patch.Upstream
package/gdb/14.2/0005-nat-fork-inferior-include-linux-ptrace.h.patch lib_patch.Upstream
package/gdb/14.2/0006-Fix-getrandom-compile-for-uclibc-v1.0.35.patch lib_patch.Upstream
package/gdb/14.2/0007-fix-musl-build-on-riscv.patch lib_patch.Upstream
package/gdb/14.2/0008-gdbserver-Makefile.in-fix-NLS-build.patch lib_patch.Upstream
package/gdb/14.2/0009-gdb-Fix-native-build-on-xtensa.patch lib_patch.Upstream
package/gdb/15.2/0001-ppc-ptrace-Define-pt_regs-uapi_pt_regs-on-GLIBC-syst.patch lib_patch.Upstream
package/gdb/15.2/0002-sh-ptrace-Define-pt_-dsp-regs-uapi_pt_-dsp-regs-on-G.patch lib_patch.Upstream
package/gdb/15.2/0003-use-asm-sgidefs.h.patch lib_patch.Upstream
@@ -370,21 +398,13 @@ package/gdb/16.3/0006-Fix-getrandom-compile-for-uclibc-v1.0.35.patch lib_patch.U
package/gdb/16.3/0007-fix-musl-build-on-riscv.patch lib_patch.Upstream
package/gdb/16.3/0008-gdbserver-Makefile.in-fix-NLS-build.patch lib_patch.Upstream
package/gdb/16.3/0009-gdb-Fix-native-build-on-xtensa.patch lib_patch.Upstream
package/gdb/17.1/0001-ppc-ptrace-Define-pt_regs-uapi_pt_regs-on-GLIBC-syst.patch lib_patch.Upstream
package/gdb/17.1/0002-sh-ptrace-Define-pt_-dsp-regs-uapi_pt_-dsp-regs-on-G.patch lib_patch.Upstream
package/gdb/17.1/0003-use-asm-sgidefs.h.patch lib_patch.Upstream
package/gdb/17.1/0004-gdbserver-fix-build-for-m68k.patch lib_patch.Upstream
package/gdb/17.1/0005-nat-fork-inferior-include-linux-ptrace.h.patch lib_patch.Upstream
package/gdb/17.1/0006-Fix-getrandom-compile-for-uclibc-v1.0.35.patch lib_patch.Upstream
package/gdb/17.1/0007-fix-musl-build-on-riscv.patch lib_patch.Upstream
package/gdb/17.1/0008-gdbserver-Makefile.in-fix-NLS-build.patch lib_patch.Upstream
package/gdb/17.1/0009-gdb-Fix-native-build-on-xtensa.patch lib_patch.Upstream
package/genpart/0001-fix-return-code.patch lib_patch.Upstream
package/gensio/0001-Fix-missing-EVP_PKEY_ED25519-build-error-on-libressl.patch lib_patch.Upstream
package/gerbera/S99gerbera lib_sysv.Indent
package/git-crypt/0001-fix-build-with-libressl-3.5.0.patch lib_patch.Upstream
package/glorytun/0001-Add-support-for-Apple-silicon.patch lib_patch.Upstream
package/glorytun/0002-aegis256.c-fix-aarch64-build-with-uclibc.patch lib_patch.Upstream
package/gnu-efi/0001-Make.defaults-don-t-override-ARCH-when-cross-compili.patch lib_patch.Upstream
package/gnupg/0001-build-Always-use-EXTERN_UNLESS_MAIN_MODULE-pattern.patch lib_patch.Upstream
package/gnuplot/0001-configure-add-without-demo-option.patch lib_patch.Upstream
package/go/go-src/0001-build.go-explicit-option-for-crosscompilation.patch lib_patch.Upstream
@@ -394,11 +414,13 @@ package/gpsd/S50gpsd Shellcheck lib_sysv.Indent lib_sysv.Variables
package/gptfdisk/0001-gptcurses-partially-revert-Tweaks-for-building-on-th.patch lib_patch.Upstream
package/gstreamer1/gstd/0001-Don-t-require-gstd-check-user-xenv.sh-for-systemd-se.patch lib_patch.Upstream
package/guile/0001-calculate-csqrt_manually.patch lib_patch.Upstream
package/guile/0002-Makefile.am-fix-build-without-makeinfo.patch lib_patch.Upstream
package/gutenprint/0001-use-pregen-xmli18n-header.patch lib_patch.Upstream
package/gutenprint/0002-cups-support-replaces-static-with-static-libtool-lib.patch lib_patch.Upstream
package/harfbuzz/0001-meson.build-check-for-pthread.h.patch lib_patch.Upstream
package/haserl/0001-add-haserl_lualib.inc.patch lib_patch.Upstream
package/haveged/S21haveged Shellcheck lib_sysv.Variables
package/heirloom-mailx/0001-fix-libressl-support.patch lib_patch.Upstream
package/hplip/0001-build-use-pkg-config-to-discover-libusb.patch lib_patch.Upstream
package/hplip/0002-configure.in-fix-AM_INIT_AUTOMAKE-call.patch lib_patch.Upstream
package/i2pd/S99i2pd Shellcheck lib_sysv.Indent lib_sysv.Variables
@@ -445,9 +467,11 @@ package/irqbalance/S13irqbalance Shellcheck lib_sysv.Indent lib_sysv.Variables
package/irrlicht/0001-override-CPPFLAGS-CXXFLAGS-and-CFLAGS-in-Makefile.patch lib_patch.Upstream
package/irrlicht/0002-makefile-override-LDFLAGS-and-remove-obsolete-X11R6-.patch lib_patch.Upstream
package/iucode-tool/S00iucode-tool lib_sysv.Variables
package/janus-gateway/0001-disable-ssp.patch lib_patch.Upstream
package/kexec-lite/0001-clean-restart.patch lib_patch.Upstream
package/keyutils/0001-fix-install-rule.patch lib_patch.Upstream
package/keyutils/0002-cifs.patch lib_patch.Sob lib_patch.Upstream
package/kmod/0001-fix-O_CLOEXEC.patch lib_patch.Upstream
package/kodi/S50kodi Shellcheck lib_sysv.Variables
package/lbase64/0001-retro-compatible-with-Lua-5.1.patch lib_patch.Upstream
package/lcdproc/0001-LCDd.conf.patch lib_patch.Upstream
@@ -457,6 +481,8 @@ package/leafnode2/0001-cross_makefile.patch lib_patch.Upstream
package/leveldb/0001-Fix-compilation-with-g-4.8.2.patch lib_patch.Upstream
package/leveldb/0002-CMake-install-libmemenv.a.patch lib_patch.Upstream
package/leveldb/0003-CMakeLists.txt-check-for-atomic-library.patch lib_patch.Upstream
package/lftp/0001-Fix-build-with-LibreSSL-following-commit-537f37898.patch lib_patch.Upstream
package/lftp/0002-src-lftp_ssl.c-fix-build-with-libressl-2.7.0.patch lib_patch.Upstream
package/libabseil-cpp/0001-force-position-independent-code.patch lib_patch.Upstream
package/libargon2/0001-libargon2-dont-fail-on-existing-symlink.patch lib_patch.Upstream
package/libart/0001-art-config-cross.patch lib_patch.Sob lib_patch.Upstream
@@ -483,6 +509,7 @@ package/libgcrypt/0001-configure.ac-add-an-option-to-disable-tests.patch lib_pat
package/libgpiod/0001-build-add-a-configure-switch-for-building-examples.patch lib_patch.Upstream
package/libgsm/0001-Misc-fixes-from-Archlinux.patch lib_patch.Upstream
package/libgtk3/0001-Remove-Gdk-dependency-from-gtk-encode-symbolic-svg.patch lib_patch.Upstream
package/libhdhomerun/0001-dont-strip.patch lib_patch.Upstream
package/libjson/0001-fix-broken-makefile.patch lib_patch.Upstream
package/libks/0001-CMakeLists.txt-honour-BUILD_TESTING.patch lib_patch.Upstream
package/liblinear/0001-build-static-lib.patch lib_patch.Upstream
@@ -514,6 +541,7 @@ package/liboping/0002-Open-raw-sockets-when-adding-hosts-not-when-doing-th.patch
package/liboping/0003-Fix-compile-break-with-GCC-7-buffer-overflow-with-snprintf.patch lib_patch.Upstream
package/liboping/0004-Fix-compile-error-on-GCC-7.patch lib_patch.Upstream
package/liboping/0005-src-oping.c-always-use-s-style-format-for-printf-sty.patch lib_patch.Upstream
package/libp11/0001-src-p11_attr.c-fix-build-with-gcc-4.8.patch lib_patch.Upstream
package/libpthsem/0001-fix-build-on-linux-3.x-host.patch lib_patch.Upstream
package/libressl/0001-always-expose-SSL_OP_NO_TLSv1_3.patch lib_patch.Upstream
package/librsvg/0001-gdk-pixbuf-loader-Makefile.am-set-GDK_PIXBUF_MODULED.patch lib_patch.Upstream
@@ -553,10 +581,12 @@ package/lirc-tools/0002-configure-add-disable-doc-option.patch lib_patch.Upstrea
package/lirc-tools/S25lircd lib_sysv.Indent lib_sysv.Variables
package/live555/0001-Add-a-pkg-config-file-for-the-shared-libraries.patch lib_patch.Upstream
package/lldpd/S60lldpd Shellcheck lib_sysv.Indent lib_sysv.Variables
package/lm-sensors/0001-no-host-ldconfig.patch lib_patch.Upstream
package/lm-sensors/0001-static-build.patch lib_patch.Upstream
package/lm-sensors/0002-no-host-ldconfig.patch lib_patch.Upstream
package/lmbench/0001-scripts-build-use-bin-bash-as-shell.patch lib_patch.Upstream
package/lmbench/0002-src-Makefile-add-lmbench-to-list-of-executables.patch lib_patch.Upstream
package/lmbench/0003-TOO_LONG-100-usec-to-prevent-memsize-from-timingout-.patch lib_patch.Upstream
package/localedef/0002-relax-dependency-on-GCC-to-4.8-and-binutils-to-2.24.patch lib_patch.Upstream
package/lockfile-progs/0001-sus3v-legacy.patch lib_patch.Sob lib_patch.Upstream
package/lshw/0001-solve-Compile-error-when-g-version-is-less-than-5.patch lib_patch.Upstream
package/ltrace/0001-arm-plt.patch lib_patch.Upstream
@@ -604,6 +634,7 @@ package/meson/0001-Prefer-ext-static-libs-when-default-library-static.patch lib_
package/meson/0002-mesonbuild-dependencies-base.py-add-pkg_config_stati.patch lib_patch.Upstream
package/mfgtools/0001-lnx_def.h-fix-conflicting-declaration-of-__time64_t.patch lib_patch.Upstream
package/mii-diag/0001-strchr.patch lib_patch.Sob lib_patch.Upstream
package/mini-snmpd/0001-linux.c-fix-musl-build.patch lib_patch.Upstream
package/minidlna/S60minidlnad Shellcheck lib_sysv.Indent lib_sysv.Variables
package/minissdpd/S50minissdpd Shellcheck lib_sysv.Indent lib_sysv.Variables
package/modem-manager/S44modem-manager Shellcheck lib_sysv.Variables
@@ -617,6 +648,7 @@ package/mpir/0001-mpn-arm-udiv.asm-workaround-binutils-bug-14887.patch lib_patch
package/mraa/0001-include-Declare-gVERSION-global-as-extern.patch lib_patch.Upstream
package/mrouted/S41mrouted NotExecutable
package/mrp/S65mrp lib_sysv.Indent lib_sysv.Variables
package/mstpd/0001-bridge-stp.in-support-different-versions-of-pidof-13.patch lib_patch.Upstream
package/multipath-tools/S60multipathd Shellcheck
package/musl/0001-avoid-kernel-if_ether.h.patch lib_patch.Upstream
package/musl/0002-package-musl-Make-scheduler-functions-Linux-compatib.patch lib_patch.Upstream
@@ -676,9 +708,8 @@ package/olsr/0006-build-patch-for-gpsd-3-25.patch lib_patch.Upstream
package/olsr/S50olsr Shellcheck lib_sysv.Indent lib_sysv.Variables
package/open-plc-utils/0001-Remove-OWNER-and-GROUPS-parameters-to-install.patch lib_patch.Upstream
package/open2300/0001-fix-makefile.patch lib_patch.Upstream
package/openjdk/17.0.18+8/0001-Add-ARCv2-ISA-processors-support-to-Zero.patch lib_patch.Upstream
package/openjdk/21.0.10+7/0001-Add-ARCv2-ISA-processors-support-to-Zero.patch lib_patch.Upstream
package/openjdk/25.0.2+10/0001-Add-ARCv2-ISA-processors-support-to-Zero.patch lib_patch.Upstream
package/openjdk/17.0.12+7/0001-Add-ARCv2-ISA-processors-support-to-Zero.patch lib_patch.Upstream
package/openjdk/21.0.4+7/0001-Add-ARCv2-ISA-processors-support-to-Zero.patch lib_patch.Upstream
package/openldap/0001-fix-bignum.patch lib_patch.Upstream
package/openldap/0002-disable-docs.patch lib_patch.Upstream
package/openntpd/S49ntp Shellcheck lib_sysv.Variables
@@ -692,6 +723,7 @@ package/openrc/0003-init.d-agetty-replace-sbin-agetty-by-sbin-getty.patch lib_pa
package/openrc/0004-init.d-agetty-start-agetty-after-all-sevices.patch lib_patch.Upstream
package/openrc/0005-runlevels-do-not-add-agetty.tty-1-6-if-MKSYSVINIT-ye.patch lib_patch.Upstream
package/openrc/0006-Also-create-run-lock-subsys-directory.patch lib_patch.Upstream
package/openswan/0001-lib-libopenswan-constants.c-workaround-missing-ns_t_.patch lib_patch.Upstream
package/opentyrian/0001-Move-definitions-that-don-t-need-to-be-exposed-from-opl-h-to-opl-c.patch lib_patch.Upstream
package/openvmtools/0001-no_cflags_werror.patch lib_patch.Upstream
package/openvmtools/0002-dont-force-cppflags.patch lib_patch.Upstream
@@ -716,6 +748,8 @@ package/paxtest/0001-genpaxtest-move-log-location.patch lib_patch.Upstream
package/paxtest/0002-paxtest-page-alignment-ARM-and-NIOS2-arch.patch lib_patch.Upstream
package/pcm-tools/0001-pmu-query.py-fix-python3-errors-add-linux-platform-s.patch lib_patch.Upstream
package/pcmanfm/0001-po-de-po-fix-build-with-gettext-tiny.patch lib_patch.Upstream
package/pcre/0001-Kill-compatibility-bits.patch lib_patch.Upstream
package/pcre/0002-Disable-C-unit-tests.patch lib_patch.Upstream
package/pdmenu/0001-autoconf-makeinfo.in-link-with-INTLLIBS-if-needed.patch lib_patch.Upstream
package/pdmenu/0002-Makefile-autoconf-makeinfo.in-support-build-install-.patch lib_patch.Upstream
package/perl-net-ssleay/0001-fix-build-system.patch lib_patch.Upstream
@@ -731,6 +765,7 @@ package/php/0004-Call-apxs-with-correct-prefix.patch lib_patch.Upstream
package/pifmrds/0001-Makefile-cross-compile-friendly.patch lib_patch.Upstream
package/pifmrds/0002-Makefile-use-LDFLAGS.patch lib_patch.Upstream
package/pifmrds/0003-Makefile-fix-static-link.patch lib_patch.Upstream
package/pigpio/S50pigpio Shellcheck lib_sysv.Variables
package/pkgconf/0001-Only-prefix-with-the-sysroot-a-subset-of-variables.patch lib_patch.Upstream
package/pkgconf/pkg-config.in Shellcheck
package/poke/0001-configure.ac-HELP2MAN-replace-by-true-when-cross-com.patch lib_patch.Upstream
@@ -748,6 +783,10 @@ package/prosody/0002-add-pidfile.patch lib_patch.Upstream
package/prosody/S50prosody Shellcheck lib_sysv.Indent lib_sysv.Variables
package/proxychains-ng/0001-add-configure-check-for-non-POSIX-compliant-getnameinfo-signature.patch lib_patch.Upstream
package/ptpd/S65ptpd Shellcheck lib_sysv.Indent lib_sysv.Variables
package/ptpd2/0001-musl.patch lib_patch.Upstream
package/ptpd2/0002-ntp_isc_md5-rename-EVP_MD_CTX-into-PTPD_EVP_MD_CTX.patch lib_patch.Upstream
package/ptpd2/0003-Solve-issue-25-Removing-type-U64-from-net-snmp-relat.patch lib_patch.Upstream
package/ptpd2/S65ptpd2 Shellcheck lib_sysv.Indent lib_sysv.Variables
package/pulseaudio/0001-shm.c-use-_Static_assert-instead-of-static_assert-fo.patch lib_patch.Upstream
package/pulseaudio/S50pulseaudio lib_sysv.ConsecutiveEmptyLines lib_sysv.EmptyLastLine lib_sysv.Indent lib_sysv.Variables
package/pulseview/0001-Replace-obsolete-deprecated-Qt-methods.patch lib_patch.Upstream
@@ -766,7 +805,11 @@ package/qextserialport/0001-Create-a-main-include-file-QExtSerialPort.patch lib_
package/qextserialport/0002-Tell-qmake-to-add-a-pkgconfig-file-to-ease-usage-wit.patch lib_patch.Upstream
package/qt5/qt5base/0001-qtbase-Fix-build-error-when-using-EGL.patch lib_patch.Upstream
package/qt5/qt5base/0002-double-conversion-enable-for-microblaze.patch lib_patch.Upstream
package/qt5/qt5base/0003-double-conversion-enable-for-nios2.patch lib_patch.Upstream
package/qt5/qt5base/0004-double-conversion-enable-for-xtensa.patch lib_patch.Upstream
package/qt5/qt5base/0005-eglfs-avoid-breaking-compilation-for-obscure-EGLNativeDisplayType-types.patch lib_patch.Upstream
package/qt5/qt5base/0006-Fix-build-on-riscv32.patch lib_patch.Upstream
package/qt5/qt5base/0007-src-corelib-configure.json-fix-atomicfptr-detection.patch lib_patch.Upstream
package/qt5/qt5base/0008-eglconvenience-add-missing-QList-include.patch lib_patch.Upstream
package/qt5/qt5declarative/0001-qsgtexture-fix-debug-build-with-uclibc.patch lib_patch.Upstream
package/qt5/qt5declarative/0002-qv4regexp_p-needs-c-limits-include-instead-of-plain-.patch lib_patch.Upstream
@@ -774,8 +817,10 @@ package/qt5/qt5enginio/0001-Do-not-use-deprecated-QLinkedList.patch lib_patch.Up
package/qt5/qt5location/0001-3rdparty-mapbox-gl-native-fix-musl-compile-pthread_g.patch lib_patch.Upstream
package/qt5/qt5script/0001-Detect-32-bits-armv8-a-architecture.patch lib_patch.Upstream
package/qt5/qt5tools/0001-Disable-designer-tool-fixes-configure-error.patch lib_patch.Upstream
package/qt5/qt5webengine-chromium/0001-Don-t-rebase-sysroot-path.patch lib_patch.Upstream
package/qt5/qt5webengine-chromium/0001-Add-python3-build-support.patch lib_patch.Upstream
package/qt5/qt5webengine-chromium/0002-Don-t-rebase-sysroot-path.patch lib_patch.Upstream
package/qt5/qt5webengine/0001-gn.pro-don-t-link-statically-with-libstc.patch lib_patch.Upstream
package/qt5/qt5webengine/0002-Add-python3-build-support.patch lib_patch.Upstream
package/qt5/qt5webkit/0001-WinCairo-PlayStation-ICU-68.1-no-longer-exposes-FALS.patch lib_patch.Upstream
package/qt5/qt5webkit/0002-Fix-compilation-with-Python-3.9-avoid-passing-encodi.patch lib_patch.Upstream
package/qt5/qt5webkit/0003-Let-Bison-generate-the-header-directly-to-fix-build-.patch lib_patch.Upstream
@@ -795,12 +840,16 @@ package/restorecond/S02restorecond Shellcheck
package/ripgrep/0001-puts-jemalloc-allocator-behind-a-cargo-feature-flag.patch lib_patch.Upstream
package/riscv-isa-sim/0001-riscv-disable-precompiled-headers.patch lib_patch.Upstream
package/rng-tools/S21rngd Shellcheck lib_sysv.Variables
package/rocksdb/0001-build_tools-build_detect_platform-fix-C-tests.patch lib_patch.Upstream
package/rpcbind/0001-Remove-yellow-pages-support.patch lib_patch.Upstream
package/rpcbind/S30rpcbind lib_sysv.EmptyLastLine lib_sysv.Indent lib_sysv.Variables
package/rt-tests/0001-Fix-a-build-issue-with-uClibc-ng.patch lib_patch.Upstream
package/rubix/0001-dont-use-legacy-functions.patch lib_patch.Upstream
package/rubix/0002-misc-fixes.patch lib_patch.Sob lib_patch.Upstream
package/rygel/S99rygel Shellcheck lib_sysv.Indent lib_sysv.Variables
package/s6-linux-init/0001-configure-add-D_GNU_SOURCE.patch lib_patch.Upstream
package/samba4/0001-build-find-pre-built-heimdal-build-tools-in-case-of-.patch lib_patch.Upstream
package/samba4/0002-ldap_message_test.c-include-stdint.h-before-cmoka.h.patch lib_patch.Upstream
package/samba4/S91smb Shellcheck lib_sysv.Indent lib_sysv.Variables
package/sane-backends/0001-sane_backend-add-missing-config.h.patch lib_patch.Upstream
package/screen/0001-Do-not-create-backup-of-old-installed-binary.patch lib_patch.Upstream
@@ -820,6 +869,9 @@ package/sentry-native/0001-sentry.h-include-ucontext.h.patch lib_patch.Upstream
package/ser2net/S50ser2net Shellcheck lib_sysv.Indent lib_sysv.Variables
package/setools/0001-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch lib_patch.Upstream
package/setserial/0001-build-system-fix.patch lib_patch.Upstream
package/shadowsocks-libev/0001-configure.ac-use-pkg-config-to-find-netfilter_conntr.patch lib_patch.Upstream
package/shadowsocks-libev/0002-fix-maybe-uninitialized-errors.patch lib_patch.Upstream
package/shadowsocks-libev/0003-lib-Makefile.am-remove-static-from-LDFLAGS.patch lib_patch.Upstream
package/shairport-sync/S99shairport-sync Shellcheck lib_sysv.Indent lib_sysv.Variables
package/shared-mime-info/0001-Remove-incorrect-dependency-from-install-data-hook.patch lib_patch.Upstream
package/shellinabox/0001-Makefile-disable-always-building-statically.patch lib_patch.Upstream
@@ -829,6 +881,14 @@ package/smcroute/S41smcroute NotExecutable lib_sysv.Indent lib_sysv.Variables
package/smstools3/0001-fix-Makefile.patch lib_patch.Upstream
package/smstools3/0002-fix-build-with-gcc-10.x.patch lib_patch.Upstream
package/smstools3/S50smsd Shellcheck lib_sysv.Variables
package/snort/0001-configure.in-Avoid-path-poisoning-with-libpcap.patch lib_patch.Upstream
package/snort/0002-configure.in-Allow-to-override-the-INADDR_NONE-check.patch lib_patch.Upstream
package/snort/0003-configure.in-convert-AC_RUN_IFELSE-to-AC_CHECK_MEMBE.patch lib_patch.Upstream
package/snort/0004-configure.in-convert-AC_RUN_IFELSE-to-AC_COMPILE_IFE.patch lib_patch.Upstream
package/snort/0005-fix-sparc.patch lib_patch.Upstream
package/snort/0006-Fix-compile-error-when-building-against-uclibc-or-mu.patch lib_patch.Upstream
package/snort/0007-Fix-error-when-building-on-a-Fedora-host-machine.patch lib_patch.Upstream
package/snort/0008-Fix-NO-OPTIMIZE.patch lib_patch.Upstream
package/solarus/0001-cmake-remove-Werror.patch lib_patch.Upstream
package/solarus/0002-Add-a-basic-FindOpenGLES2.cmake.patch lib_patch.Sob lib_patch.Upstream
package/sox/0001-Make-SoX-support-uclibc-based-toolchains.patch lib_patch.Upstream
@@ -867,6 +927,7 @@ package/ti-sgx-um/0001-Makefile-do-not-install-init-script.patch lib_patch.Upstr
package/ti-sgx-um/S80ti-sgx lib_sysv.Variables
package/ti-utils/0001-plt.h-fix-build-with-gcc-10.patch lib_patch.Upstream
package/tinyalsa/0001-include-time.h-before-asound.h.patch lib_patch.Upstream
package/tinycompress/0001-wave-add-time.h-missing-header-inclusion.patch lib_patch.Upstream
package/tinydtls/0001-sha2-sha2.c-fix-build-on-big-endian.patch lib_patch.Upstream
package/transmission/S92transmission Shellcheck lib_sysv.ConsecutiveEmptyLines lib_sysv.Indent lib_sysv.Variables
package/triggerhappy/S10triggerhappy Shellcheck lib_sysv.Indent lib_sysv.Variables
@@ -886,6 +947,7 @@ package/uhttpd/0002-Fix-TCP_FASTOPEN-related-compile-error.patch lib_patch.Upstr
package/unbound/S70unbound Shellcheck
package/unifdef/0001-Makefile-fix-error-on-install.patch lib_patch.Upstream
package/unscd/S46unscd Shellcheck lib_sysv.Indent lib_sysv.Variables
package/unzip/0001-Add-a-CMakeFile.txt-to-ease-cross-compilation.patch lib_patch.Upstream
package/upmpdcli/S99upmpdcli Shellcheck lib_sysv.Indent lib_sysv.Variables
package/urg/0001-select-h.patch lib_patch.Upstream
package/urg/0002-urg-gcc6-fix-narrowing-conversion.patch lib_patch.Upstream
@@ -901,12 +963,18 @@ package/vala/0001-dont-add-dirty-to-valac-version.patch lib_patch.Upstream
package/vala/vala-wrapper Shellcheck
package/valgrind/0001-workaround-SIGSEGV-on-PPC.patch lib_patch.Upstream
package/valgrind/0002-Define-PTRACE_GETSIGINFO-on-PowerPC-when-not-availab.patch lib_patch.Upstream
package/vboot-utils/0001-Add-missing-definition-of-MTD_CHAR_MAJOR.patch lib_patch.Upstream
package/vdr/0001-getloadavg.patch lib_patch.Upstream
package/vlc/0001-Disable-building-of-statically-linked-vlc-binary.patch lib_patch.Upstream
package/vlc/0002-automake-add-subdir-objects-option.patch lib_patch.Upstream
package/vlc/0003-build-use-pkg-config-to-get-tremor-libs.patch lib_patch.Upstream
package/vlc/0004-Fix-build-error-using-uClibc-by-adding-sys-types.h.patch lib_patch.Upstream
package/vlc/0005-Don-t-assume-strerror_l-is-available.patch lib_patch.Upstream
package/vlc/0006-posix-remove-ancient-run-time-fallback-to-real-time-.patch lib_patch.Upstream
package/vlc/0007-Add-support-for-freerdp2.patch lib_patch.Upstream
package/vlc/0008-configure.ac-also-use-AC_PATH_PROG-to-check-for-wayl.patch lib_patch.Upstream
package/vlc/0009-modules-video_filter-opencv_example.cpp-fix-build-wi.patch lib_patch.Upstream
package/vlc/0010-opengl-missing-library-check.patch lib_patch.Upstream
package/vpnc/0001-Makefile-allow-to-override-the-PREFIX-variable.patch lib_patch.Upstream
package/vpnc/0002-Makefile-allow-to-override-the-version.patch lib_patch.Upstream
package/vpnc/0003-Makefile-allow-passing-custom-CFLAGS-CPPFLAGS.patch lib_patch.Upstream
@@ -955,8 +1023,12 @@ package/x11r7/xdriver_xf86-video-mach64/0001-cross-compile.patch lib_patch.Upstr
package/x11r7/xdriver_xf86-video-tdfx/0001-cross.patch lib_patch.Upstream
package/x11r7/xserver_xorg-server/0001-include-misc.h-fix-uClibc-build.patch lib_patch.Upstream
package/x11r7/xserver_xorg-server/S40xorg Shellcheck lib_sysv.Variables
package/x11r7/xwayland/0001-include-misc.h-fix-uClibc-build.patch lib_patch.Upstream
package/xen/0001-9pfs-include-linux-limits.h-for-XATTR_SIZE_MAX.patch lib_patch.Upstream
package/xen/0002-Fix-build-with-64-bits-time_t.patch lib_patch.Upstream
package/xen/0003-libs-light-fix-tv_sec-printf-format.patch lib_patch.Upstream
package/xen/0004-libs-light-fix-tv_sec-fprintf-format.patch lib_patch.Upstream
package/xl2tp/xl2tpd lib_shellscript.TrailingSpace
package/xml-security-c/0001-fix-build-with-libressl-3.5.0.patch lib_patch.Upstream
package/yajl/0001-Let-the-shared-and-the-static-library-have-the-same-.patch lib_patch.Upstream
package/yajl/0002-cmake-disable-shared-library-build-when-BUILD_SHARED.patch lib_patch.Upstream
package/yajl/0003-Link-with-shared-libyajl-in-a-shared-build.patch lib_patch.Upstream

910
CHANGES
View File

@@ -1,346 +1,3 @@
2026.05.1, released July 15, 2026
Important / security related fixes:
apache: CVE-2026-29167, CVE-2026-29170, CVE-2026-34355, CVE-2026-34356,
CVE-2026-42535, CVE-2026-42536, CVE-2026-43951, CVE-2026-44119,
CVE-2026-44185, CVE-2026-44186, CVE-2026-44631, CVE-2026-48913,
CVE-2026-49975
asterisk: GHSA-3g56-cgrh-95p5, GHSA-3rhj-hhw7-m6fw,
GHSA-4pgv-j3mr-3rcp, GHSA-589g-qgf8-m6mx, GHSA-746q-794h-cc7f,
GHSA-8jhw-m2hg-vp3h, GHSA-8jw3-ccr9-xrmf, GHSA-g8q2-p36q-94f6,
GHSA-h5hv-jmgj-92q2, GHSA-j2mm-57pq-jh94, GHSA-mxgm-8c6f-5p8f,
GHSA-ph27-3m5q-mj5m, GHSA-q9fr-m7g8-6ph5, GHSA-qf8j-jp7h-c5hx,
GHSA-r6c2-hwc2-j4mp, GHSA-vfhr-r9x9-c687, GHSA-vrfp-mg3q-3959,
GHSA-wcvv-g26m-wx5c, GHSA-x348-j6c9-77f3, GHSA-xgj6-2gc5-5x9c
avahi: CVE-2026-34933
bind: (no CVE assigned), CVE-2026-3593
clamav: CVE-2026-20213, CVE-2026-20214, CVE-2026-20215, CVE-2026-20216,
CVE-2026-20217, CVE-2026-20243, CVE-2026-20244, CVE-2026-41676
cpp-httplib: CVE-2026-45352, CVE-2026-45372, CVE-2026-46527
cups-filters: CVE-2025-64503
expat: CVE-2026-50219, CVE-2026-56131, CVE-2026-56132, CVE-2026-56403,
CVE-2026-56404, CVE-2026-56405, CVE-2026-56406, CVE-2026-56407,
CVE-2026-56408, CVE-2026-56409, CVE-2026-56410, CVE-2026-56411,
CVE-2026-56412
fetchmail: (no CVE assigned)
ghostscript: (no CVE assigned)
gnupg2: CVE-2026-34182
imagemagick: CVE-2026-48724, CVE-2026-48733, CVE-2026-48734,
CVE-2026-48994, CVE-2026-49218, CVE-2026-49219, CVE-2026-53460,
CVE-2026-53461, CVE-2026-53462, CVE-2026-53463, CVE-2026-53464,
CVE-2026-53465
jq: CVE-2026-32316, CVE-2026-33947, CVE-2026-33948, CVE-2026-39979,
CVE-2026-40164, CVE-2026-40612, CVE-2026-41256, CVE-2026-41257,
CVE-2026-43894, CVE-2026-43896, CVE-2026-44777, CVE-2026-49839,
CVE-2026-54679, GHSA-gf4g-95wj-4q4r, GHSA-hj52-j2c9-r8r4
libarchive: (no CVE assigned)
libcurl: CVE-2026-10536, CVE-2026-11352, CVE-2026-11564,
CVE-2026-11586, CVE-2026-11856, CVE-2026-12064, CVE-2026-8286,
CVE-2026-8458, CVE-2026-8924, CVE-2026-8925, CVE-2026-8926,
CVE-2026-8927, CVE-2026-8932, CVE-2026-9079, CVE-2026-9080,
CVE-2026-9545, CVE-2026-9546, CVE-2026-9547
libevent: (no CVE assigned)
libgsasl: CVE-2026-48829
libopenssl: CVE-2026-34180, CVE-2026-34181, CVE-2026-34182,
CVE-2026-34183, CVE-2026-42764, CVE-2026-42766, CVE-2026-42767,
CVE-2026-42768, CVE-2026-42769, CVE-2026-42770, CVE-2026-45445,
CVE-2026-45446, CVE-2026-45447, CVE-2026-7383, CVE-2026-9076
libssh2: CVE-2026-55199, CVE-2026-55200
mariadb: CVE-2026-48163, CVE-2026-48165, CVE-2026-49261
mongoose: (no CVE assigned yet)
nginx: CVE-2026-42055, CVE-2026-48142
openjpeg: CVE-2026-6192
openvpn: CVE-2026-11771, CVE-2026-12932, CVE-2026-12996,
CVE-2026-13117, CVE-2026-13122, CVE-2026-13379, CVE-2026-13698
php: CVE-2026-14355
python-django: CVE-2026-35192, CVE-2026-35193, CVE-2026-48587,
CVE-2026-5766, CVE-2026-6873, CVE-2026-6907, CVE-2026-7666,
CVE-2026-8404
python3: CVE-2026-11940, CVE-2026-9669
redis: CVE-2026-23479, CVE-2026-23631, CVE-2026-25243
ruby: CVE-2026-46727
rust: CVE-2025-15661, CVE-2026-55199, CVE-2026-55200
squid: CVE-2026-47729, CVE-2026-50012
sudo: CVE-2026-35535
tiff: CVE-2026-36849
tmux: CVE-2026-11623
tor: TROVE-2026-025, TROVE-2026-026.
util-linux: CVE-2026-27456, CVE-2026-53612, CVE-2026-53613,
CVE-2026-53614
webkitgtk: CVE-2026-28847, CVE-2026-28883, CVE-2026-28901,
CVE-2026-28902, CVE-2026-28903, CVE-2026-28904, CVE-2026-28905,
CVE-2026-28907, CVE-2026-28942, CVE-2026-28946, CVE-2026-28947,
CVE-2026-28953, CVE-2026-28955, CVE-2026-28958, CVE-2026-43658,
CVE-2026-43660
wolfssl: CVE-2026-10097, CVE-2026-10098, CVE-2026-10512,
CVE-2026-10592, CVE-2026-11310, CVE-2026-11703, CVE-2026-11999,
CVE-2026-12340, CVE-2026-55958, CVE-2026-55960, CVE-2026-55961,
CVE-2026-55962, CVE-2026-55964, CVE-2026-55967, CVE-2026-6091,
CVE-2026-6092, CVE-2026-6094, CVE-2026-6291, CVE-2026-6325,
CVE-2026-6329, CVE-2026-6330, CVE-2026-6331, CVE-2026-6412,
CVE-2026-6450, CVE-2026-6678, CVE-2026-6681, CVE-2026-6731,
CVE-2026-7511, CVE-2026-7531, CVE-2026-7532, CVE-2026-8720
Toolchain:
- gcc: bump 15.x series to 15.3.0
- gcc:: bump 14.x series to 14.4.0
Infrastructure updates/fixes:
- support/testing: various internal refactorings
- support/testing Improve TestPythonPy3NetworkmanagerGoi
- support/testing: improve iptables package test
- generate-cyclonedx: fixup scp-style git sites
- support/testing: Fix test_gnupg2
Updated / fixed packages: apache, asterisk, avahi, bind, bind, clamav,
cpp-httplib, cups-filters, expat, fetchmail, gcc, gcc:, ghostscript,
gnupg2, hwdata, imagemagick, iptables, jq, jq, kodi-screensaver-rsxs,
libarchive, libcurl, libepoxy, libevent, libglib2,
libglib2-bootstrap, libgsasl, libopenssl, libssh2, libssh2, linux,
mariadb, mdnsd, mongoose, mosquitto, mpd, nginx, ntp, openjpeg,
openrc, openvpn, passt, php, python-django, python3, python3, redis,
rsync, ruby, rust, shadow, shim, squid, strongswan, sudo, tiff, tmux,
tor, util-linux, util-linux, util-linux, webkitgtk, wolfssl
2026.05, released June 8th, 2026
Various fixes.
Defconfigs: Correct legal-info for at91sam9x5ek*
(at91bootstrap3) and Arcturus ucp1020 (Linux)
Updated/fixed packages: jailhouse, libde265, libinput, libusb,
php, python3, runc
2026.05-rc4, released June 4th, 2026
Fixes all over the tree.
Infrastructure:
- dependencies: detect and reject buggy uutils 'install'
program as used in Ubuntu 26.04
- pkg-generic: Cleanup /usr/share/info/dir in the target
- generate-cyclonedx / cve-check: Various fixes for better
CycloneDX / BSI TR-03183-2 compliance
- linux: No longer forcibly disable CONFIG_WERROR
- 'make show-info-all' added, which works like 'make
show-info' but for all packages. The package hash files are
now also included in the show-info{,-all} output.
Architectures:
- Drop support for the (rare) PA-RISC 1.0 variant
Updated/fixed packages: aardvark-dns, arm-trusted-firmware,
asterisk, babeld, bpftrace, busybox, ca-certificates, cairo,
capnproto, collectd, cppdb, crucible, cups-filters,
docker-cli, docker-engine, drm-info, efl, esp-hosted, exim,
faad2, freeipmi, freeswitch, gcc-bare-metal, gdb, gerbera,
glibc, graphene, gst1-plugins-bad, gst1-plugins-good,
gstreamer1, harfbuzz, heirloom-mailx, hiredis, hplip, icu,
jemalloc, jq, kodi, lcms2, libbpf, libdill, libdrm, libenca,
libgit2, libheif, libks, libmad, libmicrohttpd,
libmodsecurity, libpthsem, libssh2, liburing, llvm-project,
lrzip, lrzsz, lua-sdl2, mesa3d, mpd, mrp, ndctl, netatalk,
netavark, odhcp6c, openblas, opencv4, opendoas, openscap, php,
podman, poppler, powerpc-utils, privoxy, python-ecdsa,
python-gymnasium, python3, qt53d, qt5webengine-chromium,
qt6base, readline, redis, rpcbind, rtl8188eu,
rtl8812au-aircrack-ng, rtl8822cs, runc, rust, rust-bin,
samba4, sane-airscan, sane-backends, sdl2_image, sqlite,
sshfs, stellarium, suricata, sway, sysrepo, tor, unzip,
ustream-ssl, util-linux, vlc, vorbis-tools, weston,
wireless-regdb, xdriver_xf86-video-nv, xen, xerces,
xserver_xorg-server, xwayland, zsh
Removed packages: daq, kodi-pvr-hdhomerun, libhdhomerun,
libphidget, phidgetwebservice, pigpio, ptpd2, xml-security-c,
zeek
2026.05-rc3, released May 29th, 2026
Fixes all over the tree.
Updated/fixed packages: kexec, libde265, libheif,
llvm-project, mariadb, mesa3d, mpd, nginx, putty,
python-urllib3, radvd, samba4, unbound
2026.05-rc2, released May 21th, 2026
Fixes all over the tree.
Updated/fixed packages: bind, cog, exim, fwts, gnupg2,
haveged, htop, imagemagick, intel-microcode, libabseil-cpp,
libargon2, libblockdev, libde265, libgphoto2, libheif, libks,
libmodsecurity, libnfs, libnss, liburiparser, libvncserver,
memcached, mongoose, mpd, openvmtools, postgresql,
python-cbor2, python-google-api-core,
python-sdbus-modemmanager, rsync, samba4, sed,
shadowsocks-libev, supertux, tzdata, weston, wireshark,
wpewebkit, zic, zlib-ng
2026.05-rc1, released May 12th, 2026
Fixes all over the tree and new features.
Architecture:
- ARM Neoverse-V1/V2/V3/V3AE cores added
- Default x86 CPU variant is now i686 (from i586)
Toolchain:
- Support for Linux 7.0.x headers
- ARM external toolchains bumped to 15.2.rel1
Filesystem:
- Support for XFS rootfs generation.
Misc:
- generate-cyclonedx now adds source attribute to known
CVEs for better compatibility with Dependency-Track.
New defconfigs: AMD Versal VPK120, TI j721e starter kit (TDA4VM-SK)
New packages: cxxopts, drm-info, ftxui, go-bootstrap-stage5,
iniparser, libnss-ato, libzippp, ndctl, opendoas,
python-cloudpickle, python-deprecation,
python-farama-notifications, python-gymnasium,
python-humanfriendly, python-isodate, python-transitions,
sbctl, ugetty, zix
Removed packages: cegui, openswan, pcre, rubix, snort,
spinxbase
2026.02.3, released June 16, 2026
Important / security related fixes:
asterisk: GHSA-8fj4-fv9f-hjpc, GHSA-g88q-c2hm-q7p7,
GHSA-j29p-pvh2-pvqp, GHSA-x5pq-qrp4-fmrj
bind: CVE-2026-3039, CVE-2026-3592, CVE-2026-5946, CVE-2026-5950
capnproto: CVE-2026-322, CVE-2026-32239, CVE-2026-32240
cups-filters: CVE-2025-64524
dnsmasq: CVE-2026-2291, CVE-2026-4890, CVE-2026-4891, CVE-2026-4892,
CVE-2026-4893, CVE-2026-5172
docker-engine: CVE-2025-54388
dropbear: CVE-2019-6111, CVE-2026-35385
exim: (no CVE assigned), CVE-2026-48840
expat: CVE-2026-45186
freeipmi: CVE-2026-50031
glibc: CVE-2026-4046, CVE-2026-4437, CVE-2026-4438, CVE-2026-5450,
CVE-2026-5928
gnupg2: (no CVE assigned)
haveged: CVE-2026-41054
imagemagick: CVE-2026-42326, CVE-2026-45031, CVE-2026-45358,
CVE-2026-45359, CVE-2026-45624, CVE-2026-45664, CVE-2026-46520,
CVE-2026-46521, CVE-2026-46522, CVE-2026-46523, CVE-2026-46557,
CVE-2026-46559
intel-microcode: CVE-2025-35979
libde265: CVE-2026-45382, CVE-2026-45383, GHSA-ccfw-29x7-rrx3,
GHSA-j2qq-x2xq-g9wr
libgpg-error: T8239
libheif: CVE-2026-32738, CVE-2026-32739, CVE-2026-32740,
CVE-2026-32741, CVE-2026-32814, CVE-2026-32882, CVE-2026-3949,
CVE-2026-41069, CVE-2026-41071, CVE-2026-47178, CVE-2026-47247,
CVE-2026-47251, CVE-2026-47254, CVE-2026-47709, CVE-2026-47714,
GHSA-5hqq-636x-r3cr, GHSA-6x5f-qchq-cxqv, GHSA-jvmp-j3cw-84mh,
GHSA-r7qj-cg5r-r6vf
libmad: CVE-2017-837, CVE-2017-8372, CVE-2017-8373, CVE-2017-8374
libmodsecurity: CVE-2026-30923, CVE-2026-42268
libssh2: CVE-2026-7598
liburiparser: CVE-2026-44927, CVE-2026-44928
libusb: CVE-2026-23679, CVE-2026-47104
libvncserver: CVE-2026-3285, CVE-2026-32853, CVE-2026-32854
mariadb: CVE-2026-34303, CVE-2026-3494, CVE-2026-44168, CVE-2026-44169,
CVE-2026-44170, CVE-2026-44171, CVE-2026-44172, CVE-2026-44173
memcached: (no CVE assigned)
nginx: CVE-2026-40460, CVE-2026-40701, CVE-2026-42926, CVE-2026-42934,
CVE-2026-42945, CVE-2026-42946, CVE-2026-9256
php: CVE-2026-44927, CVE-2026-44928
postgresql: CVE-2026-6472, CVE-2026-6473, CVE-2026-6474, CVE-2026-6475,
CVE-2026-6476, CVE-2026-6477, CVE-2026-6478, CVE-2026-6479,
CVE-2026-6575, CVE-2026-6637, CVE-2026-6638
privoxy: OVE-20260515-0001, OVE-20260515-0002
putty: (no CVE assigned)
python-urllib3: CVE-2026-44431, CVE-2026-44432
python3: CVE-2026-3276, CVE-2026-7774, CVE-2026-8328, gh-146211,
gh-146333, gh-148169, gh-148178, gh-148395, gh-149017, gh-149254,
gh-90309
radvd: CVE-2026-48715
rsync: CVE-2026-29518, CVE-2026-43617, CVE-2026-43618, CVE-2026-43619,
CVE-2026-43620, CVE-2026-45232
runc: CVE-2025-31133, CVE-2025-52565, CVE-2025-52881
samba4: CVE-2026-1933, CVE-2026-2340, CVE-2026-3012, CVE-2026-3238,
CVE-2026-4408, CVE-2026-4480
sdl2_image: CVE-2026-35444
sed: CVE-2026-5958
sshfs: CVE-2026-47187, CVE-2026-48711
tor: TROVE-2026-013, TROVE-2026-014, TROVE-2026-015, TROVE-2026-016,
TROVE-2026-017, TROVE-2026-018, TROVE-2026-019, TROVE-2026-020,
TROVE-2026-021, TROVE-2026-022
unbound: CVE-2026-32792, CVE-2026-33278, CVE-2026-40622,
CVE-2026-41292, CVE-2026-42534, CVE-2026-42923, CVE-2026-42944,
CVE-2026-42959, CVE-2026-42960, CVE-2026-44390, CVE-2026-44608
unzip: CVE-2021-4217
xserver_xorg-server: (no CVE assigned)
xwayland: (no CVE assigned)
Toolchain:
- linux-headers: bump to 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91,
6.18.33
Infrastructure updates/fixes:
- cve-check: fix vulnerabilities with different analysis
- generate-cyclonedx: add hashes from .hash files to externalReferences
- generate-cyclonedx: hint at missing Buildroot host package on a
specific error
- bump-stable-kernel-versions: update for split hash file
- kconfig: fix compiler warnings
- cve-check: add indication how to run
- Remove /usr/share/info/dir from target
- generate-cyclonedx: remove indirect dependencies from root component
- replicate IGNORE_CVES to host packages
- cve-check: remove 'bom-ref' for vulnerabilities
- generate-cyclonedx: generate externalReferences with
source-distribution
- cve-check: fix vulnerability timestamp to RFC 3339
- generate-cyclonedx: generate vcs externalReferences for source repos
- gitlab-ci: use larger shared runners where necessary
- add 'make show-info-all'
- dependencies.sh: reject buggy uutils "install" on Ubuntu 26.04
Updated defconfigs: arcturus_ucp1020, at91sam9x5ek*
Updated / fixed packages: kexec, zsh, cups-filters, python-cbor2,
haveged, lrzsz, ustream-ssl, expat, xwayland, libvncserver, liburing,
sysrepo, qt53d, collectd, mariadb, gstreamer1, jemalloc, libks,
lua-sdl2, util-linux, vlc, xfsprogs, kodi, bind, libde265,
docker-cli, libabseil-cpp, wpewebkit, libpthsem, heirloom-mailx, icu,
libheif, podman, unbound, dropbear, vorbis-tools, crucible, unzip,
libssh2, python3, imagemagick, libbpf, gdb, capnproto, esp-hosted,
freeipmi, asterisk, wireless-regdb, intel-microcode, weston,
util-linux-libs, linux-headers, qt6base, zlib-ng, libgphoto2, hplip,
bpftrace, postgresql, babeld, sed, libdrm, lrzip, odhcp6c, linux,
efl, libusb, jq, sane-airscan, libmad, faad2, dnsmasq, privoxy,
libgit2, mrp, putty, sshfs, gcc-bare-metal, graphene, mongoose,
rsync, redis, hiredis, cairo, zic, dos2unix, libargon2,
docker-engine, sane-backends, arm-trusted-firmware, libnss, openscap,
opencv4, liburiparser, libdill, radvd, poppler, tzdata,
gst1-plugins-bad, python-ecdsa, php, stellarium, python-aiodns,
nginx, gnupg2, tor, xerces, gst1-plugins-good, libmodsecurity,
sdl2_image, readline, libgpg-error, samba4, runc,
xserver_xorg-server, glibc, memcached, libmicrohttpd, supertux, exim,
python-urllib3, qt5webengine-chromium
2026.02.2, released May 20, 2026
Changes with potentially large impact:
@@ -491,6 +148,7 @@
wireless-regdb, wireshark, wolfssl, wolftpm, xdg-dbus-proxy,
xlib_libXpm, xserver_xorg-server, xwayland
2026.02.1, released April 21, 2026
Changes with potentially large impact:
@@ -582,6 +240,7 @@
python-wheel, python3, python3, quickjs, rauc, redis, sqlite, sway, tor,
uboot, uclibc, wireshark, wpebackend-fdo, xen, xz, xz, zfs
2026.02, released March 4th, 2026
Various fixes.
@@ -685,64 +344,6 @@
- How can I make the 'en_US' locale by default?
https://gitlab.com/buildroot.org/buildroot/-/issues/161
2025.11.3, released March 17, 2026
Important / security related fixes:
botan: CVE-2024-50382, CVE-2024-50383
c-ares: CVE-2025-62408
clamav: CVE-2026-20031
containerd: CVE-2024-25621, CVE-2024-40635, CVE-2025-47291,
CVE-2025-64329
cups: CVE-2025-58436, CVE-2025-61915
exiv2: CVE-2026-25884, CVE-2026-27596, CVE-2026-27631
fluidsynth: CVE-2025-56225
freerdp: CVE-2024-32661, CVE-2026-23530, CVE-2026-23531,
CVE-2026-23532, CVE-2026-23533, CVE-2026-23534, CVE-2026-23948,
CVE-2026-24675, CVE-2026-24676, CVE-2026-24679, CVE-2026-24681,
CVE-2026-24682, CVE-2026-24683
freetype: CVE-2026-23865
graphicsmagick, CVE-2025-27796
igmpproxy: CVE-2025-50681
imagemagick: CVE-2026-22770, CVE-2026-23874, CVE-2026-23876,
CVE-2026-24481, CVE-2026-25638, CVE-2026-25794, CVE-2026-25795,
CVE-2026-25796, CVE-2026-25798, CVE-2026-25799, CVE-2026-25897,
CVE-2026-25989, CVE-2026-26066, CVE-2026-26283, CVE-2026-26284,
CVE-2026-26983
jasper: CVE-2025-8836, CVE-2025-8837
libsoup3: CVE-2025-14523
libssh: CVE-2025-14821, CVE-2026-0964, CVE-2026-0965, CVE-2026-0966,
CVE-2026-0967, CVE-2026-0968
libtpms: CVE-2026-21444
mupdf: CVE-2026-25556
netsnmp: CVE-2025-68615
patch: CVE-2018-6952, CVE-2019-20633
postgresql: CVE-2026-2003, CVE-2026-2004, CVE-2026-2005, CVE-2026-2006
python-multipart: CVE-2026-24486
rtl_433: CVE-2025-34450
squid: CVE-2025-62168
tinyproxy: CVE-2025-63938
vim: CVE-2026-25749, CVE-2026-26269
wpewebkit: CVE-2025-31273, CVE-2025-31278, CVE-2025-43211,
CVE-2025-43212, CVE-2025-43216, CVE-2025-43227, CVE-2025-43228,
CVE-2025-43240, CVE-2025-43265, CVE-2025-43272, CVE-2025-43342,
CVE-2025-43343, CVE-2025-43356, CVE-2025-43368, CVE-2025-6558
Infrastructure updates/fixes:
linux: make license option visible for _CUSTOM_VERSION as well
support/testing/run-tests: fix Debian testing/unstable
Updated / fixed packages: botan, c-ares, clamav, containerd, cups,
docker, dtc, exiv2, faketime, flashbench, freerdp, freetype,
graphicsmagick, igmpproxy, imagemagick, jasper, libsoup3, libssh,
libtpms, libvips, libvirt, libzlib, mpir, mupdf, netsnmp, patch, poco,
postgresql, python3, python-multipart, qemu, rtl_433, samba4, snort,
squid, tinyproxy, util-linux, vim, webkitgtk, wireshark, wmctrl,
wpewebkit
Removed packages: qemu (cris target), python3 (ossaudiodev)
2025.11.2, released February 20, 2026
avahi: CVE-2021-3468, CVE-2023-38469, CVE-2023-38470, CVE-2023-38471,
@@ -1573,513 +1174,6 @@
- netsnmp: unexpected header length in /proc/net/snmp...
https://gitlab.com/buildroot.org/buildroot/-/issues/110
2025.02.16, released July 15, 2026
Important / security related fixes:
apache: CVE-2026-29167, CVE-2026-29170, CVE-2026-34355, CVE-2026-34356,
CVE-2026-42535, CVE-2026-42536, CVE-2026-43951, CVE-2026-44119,
CVE-2026-44185, CVE-2026-44186, CVE-2026-44631, CVE-2026-48913,
CVE-2026-49975
asterisk: GHSA-3g56-cgrh-95p5, GHSA-3rhj-hhw7-m6fw,
GHSA-4pgv-j3mr-3rcp, GHSA-589g-qgf8-m6mx, GHSA-746q-794h-cc7f,
GHSA-8jhw-m2hg-vp3h, GHSA-8jw3-ccr9-xrmf, GHSA-g8q2-p36q-94f6,
GHSA-h5hv-jmgj-92q2, GHSA-j2mm-57pq-jh94, GHSA-mxgm-8c6f-5p8f,
GHSA-ph27-3m5q-mj5m, GHSA-q9fr-m7g8-6ph5, GHSA-qf8j-jp7h-c5hx,
GHSA-r6c2-hwc2-j4mp, GHSA-vfhr-r9x9-c687, GHSA-vrfp-mg3q-3959,
GHSA-wcvv-g26m-wx5c, GHSA-x348-j6c9-77f3, GHSA-xgj6-2gc5-5x9c
avahi: CVE-2026-34933
bind: (no CVE assigned), CVE-2026-3593
cpp-httplib: CVE-2026-45352, CVE-2026-45372, CVE-2026-46527
cups-filters: CVE-2025-64503
expat: CVE-2026-50219, CVE-2026-56131, CVE-2026-56132, CVE-2026-56403,
CVE-2026-56404, CVE-2026-56405, CVE-2026-56406, CVE-2026-56407,
CVE-2026-56408, CVE-2026-56409, CVE-2026-56410, CVE-2026-56411,
CVE-2026-56412
ghostscript: (no CVE assigned)
glibc: CVE-2026-5450, CVE-2026-5928
icu: CVE-2025-5222
imagemagick: CVE-2026-48724, CVE-2026-48733, CVE-2026-48734,
CVE-2026-48994, CVE-2026-49218, CVE-2026-49219, CVE-2026-53460,
CVE-2026-53461, CVE-2026-53462, CVE-2026-53463, CVE-2026-53464,
CVE-2026-53465
jq: CVE-2026-32316, CVE-2026-33947, CVE-2026-33948, CVE-2026-39979,
CVE-2026-40164, CVE-2026-40612, CVE-2026-41256, CVE-2026-41257,
CVE-2026-43894, CVE-2026-43896, CVE-2026-44777, CVE-2026-49839,
CVE-2026-54679
libarchive: (no CVE assigned)
libcurl: CVE-2026-10536, CVE-2026-11352, CVE-2026-11564,
CVE-2026-11586, CVE-2026-11856, CVE-2026-12064, CVE-2026-8286,
CVE-2026-8458, CVE-2026-8924, CVE-2026-8925, CVE-2026-8926,
CVE-2026-8927, CVE-2026-8932, CVE-2026-9079, CVE-2026-9080,
CVE-2026-9545, CVE-2026-9546, CVE-2026-9547
libevent: (no CVE assigned)
libglib2: CVE-2025-14087
libgsasl: CVE-2026-48829
libinput: CVE-2026-50292
libopenssl: CVE-2026-34180, CVE-2026-34181, CVE-2026-34182,
CVE-2026-34183, CVE-2026-42764, CVE-2026-42766, CVE-2026-42767,
CVE-2026-42768, CVE-2026-42769, CVE-2026-42770, CVE-2026-45445,
CVE-2026-45446, CVE-2026-45447, CVE-2026-7383, CVE-2026-9076
libssh2: CVE-2026-55199, CVE-2026-55200
mariadb: CVE-2026-48163, CVE-2026-48165, CVE-2026-49261
mesa3d: CVE-2026-40393
mongoose: (no CVE assigned yet)
nginx: CVE-2026-42055, CVE-2026-48142
openjpeg: CVE-2026-6192
openvpn: CVE-2026-11771, CVE-2026-12932, CVE-2026-12996,
CVE-2026-13117, CVE-2026-13122, CVE-2026-13698
php: CVE-2026-12184, CVE-2026-14355
python-django: CVE-2026-35192, CVE-2026-35193, CVE-2026-48587,
CVE-2026-5766, CVE-2026-6873, CVE-2026-6907, CVE-2026-7666,
CVE-2026-8404
python3: CVE-2026-11940, CVE-2026-9669
redis: CVE-2026-23479, CVE-2026-23631, CVE-2026-25243
squid: CVE-2026-33515, CVE-2026-33526, CVE-2026-47729, CVE-2026-50012
sudo: CVE-2026-35535
swupdate: CVE-2026-28525
tiff: CVE-2026-36849
tor: TROVE-2026-025, TROVE-2026-026.
util-linux: CVE-2025-14104, CVE-2026-27456, CVE-2026-53612,
CVE-2026-53613, CVE-2026-53614
webkitgtk: CVE-2026-28847, CVE-2026-28883, CVE-2026-28901,
CVE-2026-28902, CVE-2026-28903, CVE-2026-28904, CVE-2026-28905,
CVE-2026-28907, CVE-2026-28942, CVE-2026-28946, CVE-2026-28947,
CVE-2026-28953, CVE-2026-28955, CVE-2026-28958, CVE-2026-43658,
CVE-2026-43660
wolfssl: CVE-2026-10097, CVE-2026-10098, CVE-2026-10512,
CVE-2026-10592, CVE-2026-11310, CVE-2026-11703, CVE-2026-11999,
CVE-2026-12340, CVE-2026-55958, CVE-2026-55960, CVE-2026-55961,
CVE-2026-55962, CVE-2026-55964, CVE-2026-55967, CVE-2026-6091,
CVE-2026-6092, CVE-2026-6094, CVE-2026-6291, CVE-2026-6325,
CVE-2026-6329, CVE-2026-6330, CVE-2026-6331, CVE-2026-6412,
CVE-2026-6450, CVE-2026-6678, CVE-2026-6681, CVE-2026-6731,
CVE-2026-7511, CVE-2026-7531, CVE-2026-7532, CVE-2026-8720
Toolchain:
- gcc: bump 14.x series to 14.4.0
- glibc, localedef: security bump to version 2.41-143-gfc7a48bc9
Infrastructure updates/fixes:
- support/testing Improve TestPythonPy3NetworkmanagerGoi
- generate-cyclonedx: fixup scp-style git sites
- support/testing: Fix test_gnupg2
- support/testing: various internal refactorings
Updated / fixed packages: apache, asterisk, avahi, bind, bind,
cpp-httplib, cpp-httplib, cups-filters, expat, gcc:, ghostscript,
glibc, hwdata, icu, imagemagick, jq, kodi-screensaver-rsxs,
libarchive, libcurl, libepoxy, libevent, libglib2, libglib2,
libglib2-bootstrap, libgsasl, libgsasl, libinput, libopenssl,
libssh2, libssh2, linux, mariadb, mdnsd, mesa3d, mongoose, mpd,
nginx, ntp, openjpeg, openrc, openvpn, php, python-django, python3,
python3, qt5, redis, rsync, ruby, shadow, shim, squid, squid, squid,
squid, strongswan, sudo, swupdate, tiff, tor, util-linux, util-linux,
util-linux, util-linux, util-linux, util-linux, webkitgtk, wolfssl
2025.02.15, released June 16, 2026
Important / security related fixes:
asterisk: GHSA-8fj4-fv9f-hjpc, GHSA-g88q-c2hm-q7p7,
GHSA-j29p-pvh2-pvqp, GHSA-x5pq-qrp4-fmrj
bind: CVE-2026-3039, CVE-2026-3592, CVE-2026-5946, CVE-2026-5950
capnproto: CVE-2026-322, CVE-2026-32239, CVE-2026-32240
cups-filters: CVE-2025-64524
dnsmasq: CVE-2026-2291, CVE-2026-4890, CVE-2026-4891, CVE-2026-4892,
CVE-2026-4893, CVE-2026-5172
dropbear: CVE-2019-6111, CVE-2026-35385
exim: (no CVE assigned), CVE-2026-48840
expat: CVE-2026-45186
freeipmi: CVE-2026-50031
glibc: CVE-2026-4046, CVE-2026-4437, CVE-2026-4438, CVE-2026-5450,
CVE-2026-5928
go: (no CVE assigned), CVE-2025-61726, CVE-2025-61728, CVE-2025-61730,
CVE-2025-61731, CVE-2025-61732, CVE-2025-68121, CVE-2025-68121,
CVE-2026-25679, CVE-2026-27137, CVE-2026-27138, CVE-2026-27139,
CVE-2026-27140, CVE-2026-27142, CVE-2026-27143, CVE-2026-27144,
CVE-2026-32280, CVE-2026-32281, CVE-2026-32283, CVE-2026-32288,
CVE-2026-32289, CVE-2026-33810, CVE-2026-33811, CVE-2026-33814,
CVE-2026-39817, CVE-2026-39819, CVE-2026-39820, CVE-2026-39823,
CVE-2026-39825, CVE-2026-39826, CVE-2026-39836, CVE-2026-42499,
CVE-2026-42501
go-bootstrap-stage5: CVE-2026-33811, CVE-2026-33814, CVE-2026-39817,
CVE-2026-39819, CVE-2026-39820, CVE-2026-39823, CVE-2026-39825,
CVE-2026-39826, CVE-2026-39836, CVE-2026-42499, CVE-2026-42501
haveged: CVE-2026-41054
imagemagick: CVE-2026-42326, CVE-2026-45031, CVE-2026-45358,
CVE-2026-45359, CVE-2026-45624, CVE-2026-45664, CVE-2026-46520,
CVE-2026-46521, CVE-2026-46522, CVE-2026-46523, CVE-2026-46557,
CVE-2026-46559
intel-microcode: CVE-2025-35979
libde265: CVE-2026-45382, CVE-2026-45383, GHSA-ccfw-29x7-rrx3,
GHSA-j2qq-x2xq-g9wr
libgpg-error: T8239
libheif: CVE-2026-32738, CVE-2026-32739, CVE-2026-32740,
CVE-2026-32741, CVE-2026-32814, CVE-2026-32882, CVE-2026-3949,
CVE-2026-41069, CVE-2026-41071, CVE-2026-47178, CVE-2026-47247,
CVE-2026-47251, CVE-2026-47254, CVE-2026-47709, CVE-2026-47714,
GHSA-5hqq-636x-r3cr, GHSA-6x5f-qchq-cxqv, GHSA-jvmp-j3cw-84mh,
GHSA-r7qj-cg5r-r6vf
libmad: CVE-2017-837, CVE-2017-8372, CVE-2017-8373, CVE-2017-8374
libmodsecurity: CVE-2026-30923, CVE-2026-42268
libssh2: CVE-2026-7598
liburiparser: CVE-2026-44927, CVE-2026-44928
libusb: CVE-2026-23679, CVE-2026-47104
libvncserver: CVE-2026-3285, CVE-2026-32853, CVE-2026-32854
linux-pam: CVE-2025-6020
mariadb: CVE-2026-34303, CVE-2026-3494, CVE-2026-44168, CVE-2026-44169,
CVE-2026-44170, CVE-2026-44171, CVE-2026-44172, CVE-2026-44173
memcached: (no CVE assigned)
nginx: CVE-2026-40460, CVE-2026-40701, CVE-2026-42926, CVE-2026-42934,
CVE-2026-42945, CVE-2026-42946, CVE-2026-9256
openssh: CVE-2025-61984, CVE-2025-61985, CVE-2026-35385,
CVE-2026-35386, CVE-2026-35387, CVE-2026-35388, CVE-2026-35414
php: CVE-2025-14179, CVE-2026-6722, CVE-2026-6735, CVE-2026-7258,
CVE-2026-7259, CVE-2026-7261, CVE-2026-7262, CVE-2026-7568
postgresql: CVE-2026-6472, CVE-2026-6473, CVE-2026-6474, CVE-2026-6475,
CVE-2026-6476, CVE-2026-6477, CVE-2026-6478, CVE-2026-6479,
CVE-2026-6575, CVE-2026-6637, CVE-2026-6638
putty: CVE-2026-48850, CVE-2026-48851, CVE-2026-48852
python-urllib3: CVE-2026-44431, CVE-2026-44432
python3: CVE-2026-3276, CVE-2026-7774, CVE-2026-8328
radvd: CVE-2026-48715
rsync: CVE-2026-29518, CVE-2026-43617, CVE-2026-43618, CVE-2026-43619,
CVE-2026-43620, CVE-2026-45232
runc: CVE-2025-31133, CVE-2025-52565, CVE-2025-52881
samba4: CVE-2026-1933, CVE-2026-2340, CVE-2026-3012, CVE-2026-3238,
CVE-2026-4408, CVE-2026-4480
sdl2_image: CVE-2026-35444
sed: CVE-2026-5958
sshfs: CVE-2026-47187, CVE-2026-48711
tor: TROVE-2026-013, TROVE-2026-014, TROVE-2026-015, TROVE-2026-016,
TROVE-2026-017, TROVE-2026-018, TROVE-2026-019, TROVE-2026-020,
TROVE-2026-021, TROVE-2026-022
unbound: CVE-2026-32792, CVE-2026-33278, CVE-2026-40622,
CVE-2026-41292, CVE-2026-42534, CVE-2026-42923, CVE-2026-42944,
CVE-2026-42959, CVE-2026-42960, CVE-2026-44390, CVE-2026-44608
unzip: CVE-2021-4217
xserver_xorg-server: (no CVE assigned)
xwayland: (no CVE assigned)
Toolchain:
- linux-headers:: bump to 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91
Infrastructure updates/fixes:
- generate-cyclonedx: generate externalReferences with
source-distribution
- Remove /usr/share/info/dir from target
- bump-stable-kernel-versions: update for split hash file
- cve-check: fix vulnerability timestamp to RFC 3339
- cve-check: remove 'bom-ref' for vulnerabilities
- generate-cyclonedx: add hashes from .hash files to externalReferences
- dependencies.sh: reject buggy uutils "install" on Ubuntu 26.04
- add 'make show-info-all'
- cve-check: fix vulnerabilities with different analysis
- kconfig: fix compiler warnings
- generate-cyclonedx: remove indirect dependencies from root component
- cve-check: add indication how to run
- generate-cyclonedx: generate vcs externalReferences for source repos
- gitlab-ci: use larger shared runners where necessary
- replicate IGNORE_CVES to host packages
- generate-cyclonedx: hint at missing Buildroot host package on a
specific error
Updated defconfigs: at91sam9x5ek*
Updated / fixed packages: libmicrohttpd, qt53d, crucible, libgit2, php,
esp-hosted, tzdata, libabseil-cpp, collectd, redis, swupdate,
libdill, zsh, samba4, haveged, arm-trusted-firmware, weston,
wireless-regdb, libssh2, go-bootstrap-stage5, jq, kodi, unbound,
lrzip, libgpg-error, hplip, expat, heimdal, glibc, go, imagemagick,
kexec, libnss, putty, libmad, vorbis-tools, libvncserver, rsync,
mongoose, intel-microcode, freeipmi, openssh, dos2unix, liburiparser,
zic, cups-filters, libks, odhcp6c, libmodsecurity, memcached,
graphene, vlc, capnproto, faad2, gcc-bare-metal, mariadb, qt6base,
python-ecdsa, runc, heirloom-mailx, icu, systemd, unzip, dnsmasq,
gst1-plugins-bad, cairo, dropbear, libusb, asterisk, hiredis,
linux-pam, sed, gstreamer1, xfsprogs, python-urllib3, radvd,
qt5webengine-chromium, sshfs, gdb, python3, sane-backends,
linux-headers:, zlib-ng, libheif, supertux, postgresql,
gst1-plugins-good, libde265, libdrm, exim, linux, lrzsz, babeld,
bind, nginx, stellarium, sdl2_image, tor, libpthsem, wpewebkit,
libargon2, xwayland, python-cbor2, xserver_xorg-server, poppler,
jemalloc
2025.02.14, released May 20, 2026
Changes with potentially large impact:
- ficl was downgraded to version 3.065 because ficl4 is no longer
maintained.
Important / security related fixes:
apache: CVE-2026-23918, CVE-2026-24072, CVE-2026-28780, CVE-2026-29168,
CVE-2026-29169, CVE-2026-33006, CVE-2026-33007, CVE-2026-33523,
CVE-2026-33857, CVE-2026-34032, CVE-2026-34059
bubblewrap: CVE-2026-41163
cups: CVE-2026-27447, CVE-2026-34978, CVE-2026-34979, CVE-2026-34980,
CVE-2026-34990, CVE-2026-39314, CVE-2026-39316, CVE-2026-41079
dash: CVE-2026-31323
dropbear: CVE-2019-6111, CVE-2026-35385
exim: CVE-2026-40684, CVE-2026-40685, CVE-2026-40686, CVE-2026-40687
expat: CVE-2026-7210, CVE-2026-41080
ffmpeg: CVE-2026-30997
freetype: CVE-2026-23865
ghostscript: (no CVE assigned)
giflib: CVE-2021-40633, CVE-2025-31344, CVE-2026-23868
gnutls: CVE-2026-33845, CVE-2026-33846, CVE-2026-3832, CVE-2026-3833,
CVE-2026-42009, CVE-2026-42010, CVE-2026-42011, CVE-2026-42012,
CVE-2026-42013, CVE-2026-42014, CVE-2026-42015, CVE-2026-5260,
CVE-2026-5419
imagemagick: CVE-2026-28493, CVE-2026-28494, CVE-2026-28686,
CVE-2026-28687, CVE-2026-28688, CVE-2026-28689, CVE-2026-28690,
CVE-2026-28691, CVE-2026-28692, CVE-2026-28693, CVE-2026-30883,
CVE-2026-30929, CVE-2026-30931, CVE-2026-30935, CVE-2026-30936,
CVE-2026-30937, CVE-2026-31853, CVE-2026-32259, CVE-2026-32636,
CVE-2026-33535, CVE-2026-33536, CVE-2026-33899, CVE-2026-33900,
CVE-2026-33901, CVE-2026-33902, CVE-2026-33905, CVE-2026-33908,
CVE-2026-34238, CVE-2026-40169, CVE-2026-40183, CVE-2026-40310,
CVE-2026-40311, CVE-2026-40312
lcms2: CVE-2026-41254, CVE-2026-42798
libcap: CVE-2026-4878
libcurl: CVE-2026-7168, CVE-2026-7009, CVE-2026-6429, CVE-2026-6276,
CVE-2026-6253, CVE-2026-5773, CVE-2026-5545, CVE-2026-4873
libexif: CVE-2026-40386, CVE-2026-40385, CVE-2026-32775
libjxl: CVE-2025-12474, CVE-2026-1837
libmicrohttpd: (no CVE assigned)
libpcap: CVE-2025-11961
libpjsip: CVE-2026-25994, CVE-2026-26203, CVE-2026-26967,
CVE-2026-29068, CVE-2026-28799, CVE-2026-32942, CVE-2026-32945,
CVE-2026-33069, CVE-2026-34235, CVE-2026-40614, CVE-2026-40892,
CVE-2026-41416, CVE-2026-41415, CVE-2026-42225, CVE-2025-65102
libspdm: GHSA-m4wc-xmvg-369f, GHSA-j54w-759w-xj3m
liburiparser: CVE-2026-42371
libxml2: CVE-2026-6732
log4cxx: CVE-2025-54812, CVE-2025-54813, CVE-2026-40023
mbedtls: CVE-2025-66442, CVE-2026-25833, CVE-2026-25834,
CVE-2026-25835, CVE-2026-34871, CVE-2026-34872, CVE-2026-34873,
CVE-2026-34874, CVE-2026-34875, CVE-2026-34876, CVE-2026-34877
musl: CVE-2026-6042, CVE-2026-40200
nginx: CVE-2026-27654, CVE-2026-27784, CVE-2026-32647, CVE-2026-27651,
CVE-2026-28753, CVE-2026-28755, CVE-2025-53859, CVE-2025-23419,
CVE-2024-7347, CVE-2024-32760, CVE-2024-31079, CVE-2024-35200,
CVE-2024-34161
opensc: CVE-2025-13763, CVE-2025-49010, CVE-2025-66215, CVE-2025-66038,
CVE-2025-66037
openvpn: CVE-2026-40215, CVE-2026-35058
p11-kit: CVE-2026-2100
p7zip: CVE-2021-3520
proftpd: CVE-2026-42167
python-cbor2: CVE-2026-26209, CVE-2025-64076, CVE-2025-68131
python-django: CVE-2026-3902, CVE-2026-4277, CVE-2026-4292,
CVE-2026-33033, CVE-2026-33034
python-pyasn1: CVE-2026-30922
python-pyopenssl: CVE-2026-27448, CVE-2026-27459
python-requests: CVE-2026-25645
python3: CVE-2024-6923, CVE-2025-13836, CVE-2025-59375
rsync: (no CVE assigned)
ruby: CVE-2026-41316
sqlite: CVE-2025-70873
strongswan: CVE-2026-25075
systemd: CVE-2026-40226
thrift: CVE-2025-48431, CVE-2026-41602, CVE-2026-41603, CVE-2026-41604,
CVE-2026-41605, CVE-2026-41606, CVE-2026-41607, CVE-2026-41636,
CVE-2026-43868, CVE-2026-43869, CVE-2026-43870
tor: CVE-2026-44597, CVE-2026-44599, CVE-2026-44600, CVE-2026-44601,
CVE-2026-44602, CVE-2026-44603
util-linux: CVE-2026-27456
webkitgtk: CVE-2026-20643, CVE-2026-20664, CVE-2026-20665,
CVE-2026-20691, CVE-2026-28857, CVE-2026-28859, CVE-2026-28861,
CVE-2026-28871, CVE-2025-43457, CVE-2025-46299, CVE-2026-20608,
CVE-2026-20635, CVE-2026-20636, CVE-2026-20644, CVE-2026-20652,
CVE-2026-20676
wolfssl: CVE-2026-5264, CVE-2026-5263, CVE-2026-5295, CVE-2026-5466,
CVE-2026-5477, CVE-2026-5447, CVE-2026-5500, CVE-2026-5501,
CVE-2026-5503, CVE-2026-5187, CVE-2026-5188, CVE-2026-5448,
CVE-2026-5772, CVE-2026-5778, CVE-2026-3548, CVE-2026-3549,
CVE-2026-3547, CVE-2026-0819, CVE-2026-1005, CVE-2026-2645,
CVE-2026-3230, CVE-2025-12888, CVE-2025-11936, CVE-2025-11935,
CVE-2025-11934, CVE-2025-11933, CVE-2025-11931, CVE-2025-11932,
CVE-2025-12889, CVE-2025-13912, CVE-2025-7395, CVE-2025-7394,
CVE-2025-7396
wolftpm: CVE-2025-7844
xlib_libXpm: CVE-2026-4367
xserver_xorg-server: CVE-2026-33999, CVE-2026-34000, CVE-2026-34001,
CVE-2026-34002, CVE-2026-34003
xwayland: CVE-2026-33999, CVE-2026-34000, CVE-2026-34001,
CVE-2026-34002, CVE-2026-34003
xz: CVE-2025-31115, CVE-2026-34743
Toolchain:
- gcc: fix GCC 12, 13 and 14 build with host gcc 16, bump 12.x series
to 12.5.0
- linux-headers: bump to 6.12.90, 6.6.140, 6.1.173, 5.15.207, 5.10.256
Infrastructure updates/fixes:
- Various improvements to pkg-stats.
New packages: libxmlsec1
Updated / fixed packages: apache, btrfs-progs, bubblewrap, c-icap,
ca-certificates, cmake, cups, dash, dropbear, exim, expat, ffmpeg,
ficl, freetype, frr, gcc, ghostscript, giflib, gnutls, haproxy,
imagemagick, initscripts, kmod, lcms2, libarchive, libcap, libcurl,
libexif, libinput, libjxl, libmicrohttpd, libpcap, libpjsip, libpng,
libsodium, libspdm, liburiparser, libxml2, linux, linux-headers,
log4cxx, mbedtls, mkpasswd, musl, mutt, neon, netsnmp,
network-manager, nginx, opensc, openssh, openvpn, p11-kit, p7zip,
proftpd, python-cbor2, python-certifi, python-django,
python-magic-wormhole, python-pyasn1, python-pyopenssl,
python-requests, python3, rsync, ruby, sqlite, strongswan, sudo,
systemd, thrift, tor, util-linux, watchdogd, webkitgtk,
wireless-regdb, wolfssl, wolftpm, xdg-dbus-proxy, xlib_libXpm,
xserver_xorg-server, xwayland, xz
2025.02.13, released April 21, 2026
Changes with potentially large impact:
- openssl was updated to 3.5.0 which has a few incompatible changes.
See https://github.com/openssl/openssl/releases/tag/openssl-3.5.0
Important / security related fixes:
asterisk: CVE-2026-23739, CVE-2026-23741, CVE-2026-23738,
CVE-2026-23740
bind: https://gitlab.isc.org/isc-projects/bind9/-/issues/5751,
CVE-2026-1519, https://gitlab.isc.org/isc-
projects/bind9/-/issues/5817, https://gitlab.isc.org/isc-
projects/bind9/-/issues/5800, https://gitlab.isc.org/isc-
projects/bind9/-/issues/5826
cpp-httplib: CVE-2026-33745, CVE-2026-34441, CVE-2026-21428,
CVE-2026-22776, CVE-2026-28434, CVE-2026-28435, CVE-2026-29076,
CVE-2026-31870, CVE-2026-32627
expat: CVE-2026-32776, CVE-2026-32777, CVE-2026-32778
gpsd: CVE-2025-67268, CVE-2025-67269
libarchive: [no CVE tracking]
libcurl: CVE-2026-3805, CVE-2026-3784, CVE-2026-3783, CVE-2026-1965
libde265: CVE-2026-33164, CVE-2026-33165
libheif: CVE-2025-68431
libmicrohttpd: CVE-2025-59777, CVE-2025-62689
libopenssl: CVE-2025-9230, CVE-2025-9231, CVE-2025-9232, CVE-2025-4575,
CVE-2025-11187, CVE-2025-15467, CVE-2025-15468, CVE-2025-15469,
CVE-2025-66199, CVE-2025-68160, CVE-2025-69418, CVE-2025-69419,
CVE-2025-69420, CVE-2025-69421, CVE-2026-22795, CVE-2026-22796,
CVE-2026-31790, CVE-2026-2673, CVE-2026-28387, CVE-2026-28388,
CVE-2026-28389, CVE-2026-28390, CVE-2026-31789
libpng: CVE-2026-33416, CVE-2026-33636, CVE-2026-34757,
GHSA-6fr7-g8h7-v645
libxml2: CVE-2026-1757, CVE-2026-0990, CVE-2026-0992, CVE-2025-10911,
CVE-2026-0989
mongoose: CVE-2025-65502
musl: CVE-2025-26519
nfs-utils: CVE-2025-12801
nghttp2: CVE-2026-27135
perl: CVE-2026-4176
python-django: CVE-2026-25673, CVE-2026-25674
python-flask: CVE-2026-27205
python-pyasn1: CVE-2026-23490
python-pyjwt: CVE-2026-32597, GHSA-752w-5fwx-jx9f
python-tornado: CVE-2025-67724, CVE-2025-67725, CVE-2025-67726
python-wheel: CVE-2026-24049
quickjs: CVE-2025-62490, CVE-2025-62491, CVE-2025-62492,
CVE-2025-62493, CVE-2025-62494, CVE-2025-62495, CVE-2025-62496
rauc: CVE-2026-34155
redis: [No CVE tracking]
ruby: CVE-2025-27221, CVE-2025-58767, CVE-2025-61594, CVE-2026-27820
tor: TROVE-2026-003, TROVE-2026-004
wireshark: CVE-2025-11626
Toolchain:
- uclibc: bump to 1.0.57
- musl: bump to 1.2.6
- linux-headers: bump to 6.12.81, 6.6.134, 6.1.168, 5.15.202, 5.10.252
Infrastructure updates/fixes:
- Add SECURITY.md
- Automatically add 2025.02.x prefix for b4 users
- generate-cyclonedx: add source attribute with NVD reference for CVEs
- Fix cve-check's CVE URLs
- New runtime test for connman.
- Added support for "secondary" target that are less often tested in
autobuilders
- New runtime test for memcached
- Fix error handling in br2-external
Updated defconfigs: aarch64_efi, nitrogen*
Updated / fixed packages: asterisk, bind, cpp-httplib, expat, faketime,
freeradius-server, giflib, gpsd, ibm-sw-tpm2, leafnode2, libarchive,
libcurl, libde265, libftdi1, libheif, libmicrohttpd, libopenssl, libpng,
libspdm, libxml2, linux, linux-headers, ltp-testsuite, luvi, mongoose,
mpd, musl, nfs-utils, nghttp2, perl, python-djange, python-flask,
python-pyasn1, python-pyjwt, python-tornado, quickjs, rauc, redis, ruby,
sway, tor, uboot, uclibc, wireshark, zfs
2025.02.12, released March 17, 2026
Important / security related fixes:
botan: CVE-2024-50382, CVE-2024-50383
c-ares: CVE-2025-62408
containerd: CVE-2024-25621, CVE-2024-40635, CVE-2025-47291,
CVE-2025-64329
cups: CVE-2025-58436, CVE-2025-61915
exiv2: CVE-2026-25884, CVE-2026-27596, CVE-2026-27631
fluidsynth: CVE-2025-56225
freerdp: CVE-2024-32661, CVE-2026-23530, CVE-2026-23531,
CVE-2026-23532, CVE-2026-23533, CVE-2026-23534, CVE-2026-23948,
CVE-2026-24675, CVE-2026-24676, CVE-2026-24679, CVE-2026-24681,
CVE-2026-24682, CVE-2026-24683
graphicsmagick, CVE-2025-27796
igmpproxy: CVE-2025-50681
imagemagick: CVE-2026-22770, CVE-2026-23874, CVE-2026-23876,
CVE-2026-24481, CVE-2026-25638, CVE-2026-25794, CVE-2026-25795,
CVE-2026-25796, CVE-2026-25798, CVE-2026-25799, CVE-2026-25897,
CVE-2026-25989, CVE-2026-26066, CVE-2026-26283, CVE-2026-26284,
CVE-2026-26983
jasper: CVE-2025-8836, CVE-2025-8837
libsoup3: CVE-2025-14523
libssh: CVE-2025-14821, CVE-2026-0964, CVE-2026-0965, CVE-2026-0966,
CVE-2026-0967, CVE-2026-0968
libtpms: CVE-2026-21444
mupdf: CVE-2026-25556
netsnmp: CVE-2025-68615
patch: CVE-2018-6952, CVE-2019-20633
postgresql: CVE-2026-2003, CVE-2026-2004, CVE-2026-2005, CVE-2026-2006
rtl_433: CVE-2025-34450
squid: CVE-2025-62168
tinyproxy: CVE-2025-63938
vim: CVE-2026-25749, CVE-2026-26269
wpewebkit: CVE-2025-31273, CVE-2025-31278, CVE-2025-43211,
CVE-2025-43212, CVE-2025-43216, CVE-2025-43227, CVE-2025-43228,
CVE-2025-43240, CVE-2025-43265, CVE-2025-43272, CVE-2025-43342,
CVE-2025-43343, CVE-2025-43356, CVE-2025-43368, CVE-2025-6558
Infrastructure updates/fixes:
linux: make license option visible for _CUSTOM_VERSION as well
support/testing/run-tests: fix Debian testing/unstable
Updated / fixed packages: botan, c-ares, containerd, cups, dtc, exiv2,
faketime, flashbench, fluidsynth, freerdp, graphicsmagick, igmpproxy,
imagemagick, jasper, libsoup3, libssh, libtpms, libvips, libvirt,
libzlib, mupdf, netsnmp, patch, poco, postgresql, python-multipart,
qemu, rtl_433, squid, tinyproxy, util-linux, vim, webkitgtk, wmctrl,
wpewebkit
Removed packages: qemu (cris target)
2025.02.11, released February 20, 2026
avahi: CVE-2021-3468, CVE-2023-38469, CVE-2023-38470, CVE-2023-38471,

View File

@@ -101,6 +101,11 @@ config BR2_HOST_GCC_AT_LEAST_15
# When adding new entries above, be sure to update
# the HOSTCC_MAX_VERSION variable in the Makefile.
# Hidden boolean selected by packages in need of Java in order to build
# (example: kodi)
config BR2_NEEDS_HOST_JAVA
bool
# Hidden boolean selected by pre-built packages for x86, when they
# need to run on x86-64 machines (example: pre-built external
# toolchains, binary tools, etc.).

View File

@@ -144,199 +144,7 @@ endif
###############################################################################
comment "Legacy options removed in 2026.08"
config BR2_PACKAGE_TS4900_FPGA
bool "ts4900-fpga removed"
select BR2_LEGACY
help
The ts4900 defconfig was removed, so ts4900-fpga package
has been dropped.
config BR2_GDB_VERSION_14
bool "gdb 14.x has been removed"
select BR2_LEGACY
help
GDB 14.x support has been removed, a newer version should be
used instead.
config BR2_PACKAGE_ARGPARSE
bool "argparse has been removed"
select BR2_LEGACY
select BR2_PACKAGE_LUA_ARGPARSE
help
Package argparse duplicates the package lua-argparse.
config BR2_KERNEL_HEADERS_7_0
bool "kernel headers version 7.0.x are no longer supported"
select BR2_LEGACY
help
Version 7.0.x of the Linux kernel headers are no longer
maintained upstream and are now removed.
config BR2_PACKAGE_BLUEZ5_UTILS_PLUGINS_SAP
bool "bluez sap plugin removed"
select BR2_LEGACY
help
Build plugin for SAP profile.
config BR2_PACKAGE_BLUEZ5_UTILS_PLUGINS_HEALTH
bool "bluez health plugin removed"
select BR2_LEGACY
help
Build plugin for health profiles.
config BR2_GCC_VERSION_13_X
bool "gcc 13.x support removed"
select BR2_LEGACY
help
Support for building a toolchain based on GCC 13.x has been
removed, chose a newer GCC version instead.
config BR2_PACKAGE_QEMU_TARGET_MICROBLAZEEL
bool "qemu target microblazeel removed"
select BR2_PACKAGE_QEMU_TARGET_MICROBLAZE
select BR2_LEGACY
help
Version 11.0.0 of qemu folded microblazeel support into
the microblaze target.
comment "Legacy options removed in 2026.05"
config BR2_PACKAGE_PTPD2
bool "ptpd2 removed"
select BR2_LEGACY
help
ptpd2 was no longer maintained upstream, so it has been
dropped.
config BR2_PACKAGE_LIBHDHOMERUN
bool "libhdhomerun"
select BR2_LEGACY
help
libhdhomerun was removed from Buildroot as it was
insufficiently maintained. It can be re-added if someone
volunteers to maintain it.
config BR2_PACKAGE_KODI_PVR_HDHOMERUN
bool "kodi-pvr-hdhomerun"
select BR2_LEGACY
help
kodi-pvr-hdhomerun was removed from Buildroot as it was
insufficiently maintained. It can be re-added if someone
volunteers to maintain it.
config BR2_PACKAGE_ZEEK
bool "zeek removed"
select BR2_LEGACY
help
The zeek package was not maintained, with numerous build
issues and severely lagging behind upstream. so it has been
dropped.
config BR2_PACKAGE_PIGPIO
bool "pigpio removed"
select BR2_LEGACY
help
pigpio was no longer maintained upstream, so it has been
dropped.
config BR2_PACKAGE_XML_SECURITY_C
bool "xml-security-c removed"
select BR2_LEGACY
help
xml-security-c was no longer maintained upstream, so it has
been dropped.
config BR2_PACKAGE_LIBPHIDGET
bool "libphidget"
select BR2_LEGACY
help
libphidget was removed from Buildroot as it was
insufficiently maintained. It can be re-added if someone
volunteers to maintain it.
config BR2_PACKAGE_PHIDGETWEBSERVICE
bool "phidgetwebservice"
select BR2_LEGACY
help
phidgetwebservice was removed from Buildroot as it was
insufficiently maintained. It can be re-added if someone
volunteers to maintain it.
config BR2_PACKAGE_DAQ
bool "daq removed"
select BR2_LEGACY
help
The only dependee, snort, has been removed. Look at daq3
for an alternative.
config BR2_PACKAGE_FWTS_EFI_RUNTIME_MODULE
bool "fwts efi_runtime kernel module removed"
select BR2_LEGACY
help
The fwts efi_runtime module has been removed in V26.01.00.
The Kernel efi_test (Kernel CONFIG_EFI_TEST) should be used
instead.
config BR2_KERNEL_HEADERS_6_19
bool "kernel headers version 6.19.x are no longer supported"
select BR2_LEGACY
help
Version 6.19.x of the Linux kernel headers are no longer
maintained upstream and are now removed.
config BR2_PACKAGE_PCRE
bool "pcre removed"
select BR2_LEGACY
help
pcre was no longer maintained upstream, so it has been
dropped. Look at pcre2 for an alternative.
config BR2_PACKAGE_SNORT
bool "snort removed"
select BR2_LEGACY
help
snort was no longer maintained upstream, so it has been
dropped. Look at snort3 for an alternative.
config BR2_PACKAGE_CEGUI
bool "cegui"
select BR2_LEGACY
help
cegui was removed from Buildroot as it was insufficiently
maintained. It can be re-added if someone volunteers to
maintain it.
config BR2_PACKAGE_SPHINXBASE
bool "sphinxbase removed"
select BR2_LEGACY
help
sphinxbase was no longer maintained upstream, so it has
been dropped.
config BR2_PACKAGE_OPENSWAN
bool "openswan removed"
select BR2_LEGACY
help
Openswan was no longer maintained upstream, so it has
been dropped.
config BR2_PACKAGE_RUBIX
bool "rubix removed"
select BR2_LEGACY
help
Rubix was no longer maintained upstream, so it has
been dropped.
config BR2_PACKAGE_LLAMA_CPP_SERVER
bool "llama-cpp option removed"
select BR2_PACKAGE_LLAMA_CPP_TOOLS
select BR2_LEGACY
help
Several tools (server, cli) now require building both
tools and server, so enable both with the same config
BR2_PACKAGE_LLAMA_CPP_TOOLS
comment "Legacy options removed in 2026.02.1"
config BR2_PACKAGE_PYTHON3_OSSAUDIODEV
bool "python3 ossaudiodev module removed"
@@ -344,27 +152,6 @@ config BR2_PACKAGE_PYTHON3_OSSAUDIODEV
help
The ossaudiodev module was removed in Python 3.13.
config BR2_TARGET_EDK2_PLATFORM_OVMF_I386
bool "EDK2 OVMF IA32 removed"
select BR2_LEGACY
help
EDK2 OVMF IA32 support was removed in upstream version
202511, so it has been dropped.
config BR2_BINUTILS_VERSION_2_43_X
bool "binutils 2.43 has been removed"
select BR2_LEGACY
help
binutils 2.43 has been removed, select a newer version
instead.
config BR2_parisc10
bool "PA-RISC architecture version 1.0 support removed"
select BR2_LEGACY
help
Following the build issues with glibc 2.43, Buildroot has
removed support for this architecture version.
comment "Legacy options removed in 2026.02"
config BR2_PACKAGE_QEMU_TARGET_CRIS
@@ -3685,12 +3472,12 @@ config BR2_PACKAGE_KODI_LIBTHEORA
Kodi does not need libtheora
config BR2_PACKAGE_CEGUI06
bool "BR2_PACKAGE_CEGUI06 was removed"
bool "BR2_PACKAGE_CEGUI06 was renamed"
select BR2_PACKAGE_CEGUI
select BR2_LEGACY
help
cegui06 was removed from Buildroot as it was insufficiently
maintained. It can be re-added if someone volunteers to
maintain it.
The BR2_PACKAGE_CEGUI06 config symbol was renamed to
BR2_PACKAGE_CEGUI.
config BR2_GCC_VERSION_5_X
bool "gcc 5.x support removed"

View File

@@ -158,8 +158,6 @@ N: Alexis Lothoré <alexis.lothore@bootlin.com>
F: package/libxmlsec1/
F: package/openscap/
F: package/python-scp/
F: support/testing/tests/package/test_libldns.py
F: support/testing/tests/package/test_python_scp.py
N: Alistair Francis <alistair@alistair23.me>
F: board/sifive/
@@ -168,9 +166,6 @@ F: configs/hifive_unleashed_defconfig
F: package/libspdm/
F: package/xen/
N: Alsey Coleman Miller <alseycmiller@gmail.com>
F: package/liblc3/
N: Alvaro G. M <alvaro.gamez@hazent.com>
F: package/dcron/
F: package/libxmlrpc/
@@ -191,7 +186,6 @@ F: package/wine/
N: Andrea Ricchi <andrea.ricchi@amarulasolutions.com>
F: package/cutekeyboard/
F: package/libcppconnman/
N: Andreas Klinger <ak@it-klinger.de>
F: package/ply/
@@ -249,7 +243,6 @@ F: package/python-pillow/
F: package/python-pydal/
F: package/python-spidev/
F: package/python-web2py/
F: package/qpdf/
F: package/qt5/qt5coap/
F: package/qt5/qt5knx/
F: package/qt5/qt5mqtt/
@@ -376,7 +369,6 @@ F: package/bcg729/
F: package/bento4/
F: package/bitcoin/
F: package/clamav/
F: package/cxxopts/
F: package/dav1d/
F: package/dht/
F: package/dnsmasq/
@@ -434,6 +426,7 @@ F: package/libfribidi/
F: package/libg7221/
F: package/libglew/
F: package/libglu/
F: package/libhdhomerun/
F: package/libheif/
F: package/libid3tag/
F: package/libilbc/
@@ -452,7 +445,6 @@ F: package/libsidplay2/
F: package/libsilk/
F: package/libsndfile/
F: package/libsoundtouch/
F: package/libudev-zero/
F: package/libudfread/
F: package/libunibreak/
F: package/liburiparser/
@@ -465,7 +457,6 @@ F: package/libvorbis/
F: package/libvpl/
F: package/libvpx/
F: package/libyuv/
F: package/libzippp/
F: package/linux-firmware/
F: package/mc/
F: package/mesa3d/
@@ -521,7 +512,6 @@ F: package/python-pyicu/
F: package/python-pylru/
F: package/python-requests-oauthlib/
F: package/python-slob/
F: package/qt6/qt6positioning/
F: package/rrdtool/
F: package/rsync/
F: package/rtmpdump/
@@ -539,14 +529,12 @@ F: package/unixodbc/
F: package/utfcpp/
F: package/vlc/
F: package/wget/
F: package/wget2/
F: package/wireless-regdb/
F: package/wireless_tools/
F: package/x264/
F: package/x265/
F: package/xmrig/
F: package/ytree/
F: package/zix/
F: package/znc/
F: support/testing/tests/package/test_perl_html_parser.py
@@ -622,10 +610,6 @@ F: package/alsa-plugins/
N: Changming Huang <jerry.huang@nxp.com>
F: package/qoriq-cadence-dp-firmware/
N: Chen Pei <cp0613@linux.alibaba.com>
F: package/iniparser/
F: package/ndctl/
N: Chris Packham <judge.packham@gmail.com>
F: package/coremark/
F: package/coremark-pro/
@@ -712,9 +696,6 @@ F: package/perl-sys-mmap/
F: package/perl-time-parsedate/
F: package/perl-x10/
N: Christopher Obbard <obbardc@gmail.com>
F: package/dtui/
N: Colin Foster <colin.foster@in-advantage.com>
F: package/python-tftpy/
F: package/rauc-hawkbit-updater/
@@ -822,7 +803,6 @@ F: package/babeld/
F: package/bc/
F: package/cmocka/
F: package/connman/
F: package/drogon/
F: package/empty/
F: package/iana-assignments/
F: package/inih/
@@ -1115,6 +1095,7 @@ F: package/tinycbor/
F: package/tinydtls/
F: package/whois/
F: package/x11r7/xlib_libXpresent/
F: package/zeek/
N: Fabrice Goucem <fabrice.goucem@oss.nxp.com>
F: board/freescale/imx6ullevk/
@@ -1152,7 +1133,6 @@ F: package/cpulimit/
N: Florian Larysch <fl@n621.de>
F: package/casync-nano/
F: package/sigsum-c/
F: package/sigsum-go/
N: Floris Bos <bos@je-eigen-domein.nl>
@@ -1177,7 +1157,7 @@ F: board/visionfive2/
F: configs/sipeed_licheepi_nano_defconfig
F: configs/visionfive2_defconfig
N: Francois Perrad <francois.perrad.86@gmail.com>
N: Francois Perrad <francois.perrad@gadz.org>
F: board/olimex/a20_olinuxino
F: board/olimex/imx233_olinuxino/
F: board/olimex/stmp1_olinuxino/
@@ -1191,9 +1171,7 @@ F: package/copas/
F: package/coxpcall/
F: package/dado/
F: package/ficl/
F: package/hare*
F: package/janet/
F: package/qbe/
F: package/libtomcrypt/
F: package/libtommath/
F: package/linenoise/
@@ -1207,14 +1185,11 @@ F: package/lua*
F: package/lynis/
F: package/lzlib/
F: package/moarvm/
F: package/opendoas/
F: package/perl*
F: package/pkg-hare.mk
F: package/pkg-perl.mk
F: package/pkg-luarocks.mk
F: package/quickjs/
F: package/rings/
F: package/scdoc/
F: package/wsapi/
F: package/wsapi-fcgi/
F: package/wsapi-xavante/
@@ -1274,7 +1249,6 @@ F: package/cctz/
F: package/clpeak/
F: package/faad2/
F: package/fdk-aac/
F: package/ftxui/
F: package/httping/
F: package/iozone/
F: package/leptonica/
@@ -1374,6 +1348,7 @@ F: fs/f2fs/
F: package/bluez5_utils-headers/
F: package/f2fs-tools/
F: package/graphicsmagick/
F: package/pigpio/
F: package/python-aioblescan/
F: package/python-bluezero/
F: package/python-crontab/
@@ -1676,7 +1651,6 @@ F: package/ssdp-responder/
F: package/sysklogd/
F: package/uredir/
F: package/watchdogd/
F: support/testing/tests/package/test_mdnsd.py
N: Jochen Baltes <jochen.baltes@gmail.com>
F: package/altera-stapl
@@ -1729,6 +1703,10 @@ F: package/nginx-dav-ext/
N: John Stile <johns@msli.com>
F: package/dhcpcd/
N: John Faith <jfaith@impinj.com>
F: package/python-inflection/
F: package/sdbusplus/
N: Jon Ringle <jringle@gridpoint.com>
F: package/mbpoll/
@@ -1739,7 +1717,10 @@ N: Jonathan Ben Avraham <yba@tkos.co.il>
F: arch/Config.in.xtensa
F: package/autofs/
F: package/dawgdic/
F: package/libphidget/
F: package/phidgetwebservice/
F: package/rapidxml/
F: package/sphinxbase/
N: Joris Offouga <offougajoris@gmail.com>
F: package/python-colorlog/
@@ -1765,7 +1746,6 @@ F: package/llama-cpp/
F: package/llvm-project/clang/
F: package/llvm-project/lld/
F: package/llvm-project/llvm/
F: package/mesa3d/
F: package/python-cython/
F: package/python-pycups/
F: package/python-raven/
@@ -1776,8 +1756,6 @@ F: package/python-xlib/
F: package/sentry-cli/
F: package/sentry-native/
F: package/unclutter-xfixes/
F: package/virglrenderer/
F: support/testing/tests/package/test_virglrenderer.py
N: Joshua Henderson <joshua.henderson@microchip.com>
F: package/qt5/qt5wayland/
@@ -1858,8 +1836,6 @@ F: support/testing/tests/fs/test_btrfs.py
F: support/testing/tests/fs/test_btrfs/
F: support/testing/tests/fs/test_erofs.py
F: support/testing/tests/fs/test_erofs/
F: support/testing/tests/fs/test_xfs.py
F: support/testing/tests/fs/test_xfs/
F: support/testing/tests/package/sample_python_distro.py
F: support/testing/tests/package/sample_python_gnupg.py
F: support/testing/tests/package/sample_python_hwdata.py
@@ -1867,7 +1843,6 @@ F: support/testing/tests/package/sample_python_midiutil.py
F: support/testing/tests/package/sample_python_ml_dtypes.py
F: support/testing/tests/package/sample_python_mpmath.py
F: support/testing/tests/package/sample_python_pyalsa.py
F: support/testing/tests/package/sample_python_pydal.py
F: support/testing/tests/package/sample_python_spake2.py
F: support/testing/tests/package/sample_python_sympy.py
F: support/testing/tests/package/test_4th.py
@@ -1911,7 +1886,6 @@ F: support/testing/tests/package/test_fluidsynth.py
F: support/testing/tests/package/test_fluidsynth/
F: support/testing/tests/package/test_fping.py
F: support/testing/tests/package/test_fwts.py
F: support/testing/tests/package/test_fwts/
F: support/testing/tests/package/test_gawk.py
F: support/testing/tests/package/test_ghostscript.py
F: support/testing/tests/package/test_ghostscript/
@@ -1926,8 +1900,6 @@ F: support/testing/tests/package/test_gnuradio/
F: support/testing/tests/package/test_gpsd.py
F: support/testing/tests/package/test_gpsd/
F: support/testing/tests/package/test_gstreamer1.py
F: support/testing/tests/package/test_guile.py
F: support/testing/tests/package/test_guile/
F: support/testing/tests/package/test_gzip.py
F: support/testing/tests/package/test_highway.py
F: support/testing/tests/package/test_hwloc.py
@@ -1955,8 +1927,6 @@ F: support/testing/tests/package/test_libcamera.py
F: support/testing/tests/package/test_libcamera/
F: support/testing/tests/package/test_libcurl.py
F: support/testing/tests/package/test_libgpgme.py
F: support/testing/tests/package/test_libgpiod2.py
F: support/testing/tests/package/test_libgpiod2/
F: support/testing/tests/package/test_libjxl.py
F: support/testing/tests/package/test_lighttpd.py
F: support/testing/tests/package/test_links.py
@@ -1990,8 +1960,6 @@ F: support/testing/tests/package/test_nftables.py
F: support/testing/tests/package/test_nftables/
F: support/testing/tests/package/test_ngrep.py
F: support/testing/tests/package/test_nmap.py
F: support/testing/tests/package/test_ndctl.py
F: support/testing/tests/package/test_ndctl/
F: support/testing/tests/package/test_ntp.py
F: support/testing/tests/package/test_ntp/
F: support/testing/tests/package/test_numactl.py
@@ -2006,8 +1974,6 @@ F: support/testing/tests/package/test_patch.py
F: support/testing/tests/package/test_patch/
F: support/testing/tests/package/test_pciutils.py
F: support/testing/tests/package/test_perftest.py
F: support/testing/tests/package/test_php.py
F: support/testing/tests/package/test_php/
F: support/testing/tests/package/test_pigz.py
F: support/testing/tests/package/test_postgresql.py
F: support/testing/tests/package/test_pppd.py
@@ -2023,7 +1989,6 @@ F: support/testing/tests/package/test_python_midiutil.py
F: support/testing/tests/package/test_python_ml_dtypes.py
F: support/testing/tests/package/test_python_mpmath.py
F: support/testing/tests/package/test_python_pyalsa.py
F: support/testing/tests/package/test_python_pydal.py
F: support/testing/tests/package/test_python_pyqt5.py
F: support/testing/tests/package/test_python_pyqt5/
F: support/testing/tests/package/test_python_spake2.py
@@ -2123,7 +2088,6 @@ F: board/octavo/osd32mp1-brk/
F: board/octavo/osd32mp1-red/
F: configs/octavo_osd32mp1_brk_defconfig
F: configs/octavo_osd32mp1_red_defconfig
F: package/drm-info/
N: Kris Bahnsen <kris@embeddedTS.com>
F: package/wilc-firmware/
@@ -2266,10 +2230,10 @@ F: board/orangepi/orangepi-zero3/
F: configs/grinn_*
F: configs/orangepi_zero_plus_defconfig
F: configs/orangepi_zero3_defconfig
F: package/argparse/
F: package/dt-utils/
F: package/easydbus/
F: package/gitlab-runner/
F: package/lua-argparse/
F: package/lua-flu/
F: package/lua-stdlib/
F: package/luaossl/
@@ -2293,8 +2257,6 @@ F: support/testing/tests/package/sample_python_dbus_fast.py
F: support/testing/tests/package/sample_python_dbus_next.py
F: support/testing/tests/package/sample_python_pytest.py
F: support/testing/tests/package/sample_python_pytest_asyncio.py
F: support/testing/tests/package/test_easydbus.py
F: support/testing/tests/package/test_easydbus/
F: support/testing/tests/package/test_netdata.py
F: support/testing/tests/package/test_python_dbus_next.py
F: support/testing/tests/package/test_python_pytest.py
@@ -2394,6 +2356,26 @@ F: package/gtkiostream/
N: Matt Silva <dev@matt-silva.com>
F: package/rlwrap/
N: Mauro Condarelli <mc5686@mclink.it>
F: package/mc/
F: package/python-autobahn/
F: package/python-cbor/
F: package/python-characteristic/
F: package/python-click/
F: package/python-lmdb/
F: package/python-mistune/
F: package/python-netaddr/
F: package/python-pygments/
F: package/python-pynacl/
F: package/python-pytrie/
F: package/python-service-identity/
F: package/python-setproctitle/
F: package/python-shutilwhich/
F: package/python-treq/
F: package/python-txaio/
F: package/python-ujson/
F: package/python-wsaccel/
N: Maksim Kiselev <bigunclemax@gmail.com>
F: package/ledmon/
@@ -2429,10 +2411,6 @@ F: configs/arcturus_ucls1012a_defconfig
N: Michael Fischer <mf@go-sys.de>
F: package/gnuplot/
F: package/sdl2/
F: package/sdl3/
F: package/sdl3_gfx/
F: package/sdl3_image/
F: package/sdl3_ttf/
N: Michael Nosthoff <buildroot@heine.tech>
F: package/boost/
@@ -2510,7 +2488,6 @@ F: boot/xilinx-embeddedsw/
F: boot/xilinx-prebuilt/
F: configs/versal_vck190_defconfig
F: configs/versal_vek280_defconfig
F: configs/versal_vpk120_defconfig
F: configs/versal_vpk180_defconfig
F: configs/versal2_vek385_defconfig
F: configs/zynq_zc702_defconfig
@@ -2525,8 +2502,6 @@ F: package/binutils-bare-metal/
F: package/bootgen/
F: package/gcc-bare-metal/
F: package/newlib-bare-metal/
F: package/qemu-xen/
F: package/xen/
F: package/xilinx-fpgautil/
F: toolchain/toolchain-bare-metal-buildroot/
@@ -2678,7 +2653,6 @@ F: configs/orangepi_pc_defconfig
F: configs/orangepi_r1_defconfig
F: configs/sheevaplug_defconfig
F: configs/visionfive_defconfig
F: package/agec/
F: package/bats-core/
F: package/dfu-programmer/
F: package/docker-compose/
@@ -2710,10 +2684,8 @@ F: package/rnnoise/
F: package/sedutil/
F: package/tpm2-totp/
F: package/triggerhappy/
F: package/ugetty/
F: package/wireguard-linux-compat/
F: package/wireguard-tools/
F: support/testing/tests/package/test_agec.py
F: support/testing/tests/package/test_docker_compose.py
F: support/testing/tests/package/test_python_hid.py
@@ -2804,6 +2776,10 @@ F: package/synergy/
N: Qais Yousef <qais.yousef@arm.com>
F: package/bpftrace/
N: Rafal Susz <rafal.susz@gmail.com>
F: board/avnet/s6lx9_microboard/
F: configs/s6lx9_microboard_defconfig
N: Rafał Miłecki <rafal@milecki.pl>
F: board/broadcom/northstar/
F: configs/broadcom_northstar_defconfig
@@ -3045,9 +3021,11 @@ F: package/aoetools/
F: package/asn1c/
F: package/azure-iot-sdk-c/
F: package/curlpp/
F: package/daq/
F: package/libgdiplus/
F: package/pimd/
F: package/sloci-image/
F: package/snort/
F: package/stella/
F: package/tio/
F: package/traceroute/
@@ -3058,13 +3036,7 @@ F: package/wolfssl/
N: Shubham Chakraborty <chakrabortyshubham66@gmail.com>
F: package/ccache/
F: package/dos2unix/
F: package/font-awesome/
F: package/htop/
F: package/hyperfine/
F: package/libenca/
F: package/pv/
F: package/unrar/
F: package/xterm/
N: Simon Dawson <spdawson@gmail.com>
F: boot/at91bootstrap3/
@@ -3294,7 +3266,6 @@ F: support/testing/tests/package/sample_python_augeas.py
F: support/testing/tests/package/sample_python_flask.py
F: support/testing/tests/package/sample_python_flask_expects_json.py
F: support/testing/tests/package/sample_python_git.py
F: support/testing/tests/package/sample_python_pyudev.py
F: support/testing/tests/package/sample_python_unittest_xml_reporting.py
F: support/testing/tests/package/test_nodejs.py
F: support/testing/tests/package/test_python_augeas.py
@@ -3304,7 +3275,6 @@ F: support/testing/tests/package/test_python_flask_expects_json.py
F: support/testing/tests/package/test_python_fs.py
F: support/testing/tests/package/test_python_git.py
F: support/testing/tests/package/test_python_pyfatfs.py
F: support/testing/tests/package/test_python_pyudev.py
F: support/testing/tests/package/test_python_pyusb.py
F: support/testing/tests/package/test_python_serial.py
F: support/testing/tests/package/test_snagboot.py
@@ -3359,26 +3329,19 @@ F: package/llvm-project/llvm/
N: Vanya Sergeev <vsergeev@gmail.com>
F: package/lua-periphery/
N: Viacheslav Bocharov <v@baodeep.com>
F: package/amlogic-boot-fip/
N: Viacheslav Bocharov <adeep@lexina.in>
F: package/rtl8822cs/
N: Victor Huesca <victor.huesca@bootlin.com>
F: support/testing/tests/core/test_root_password.py
N: Vincent Cruz <mooz@blockos.org>
F: package/python-transitions/
N: Vincent Jardin <vjardin@free.fr>
F: board/nvidia/bf3/
F: configs/nvidia_bf3_defconfig
F: package/bfscripts/
F: package/dpdk/
F: package/libecoli/
F: package/libnss-ato/
F: package/libyang-cpp/
F: package/python-libyang/
F: package/python-sysv-ipc/
F: package/sysrepo-cpp/
N: Vincent Prince <vincent.prince.fr@gmail.com>
@@ -3386,13 +3349,11 @@ F: package/nss-myhostname/
F: package/utp_com/
N: Vincent Stehlé <vincent.stehle@arm.com>
F: board/aarch64-efi/
F: board/arm/fvp-ebbr/
F: board/compulab/iot-gate-imx8-ebbr/
F: board/pine64/rockpro64-ebbr/
F: board/qemu/aarch64-ebbr/
F: board/qemu/arm-ebbr/
F: configs/aarch64_efi_defconfig
F: configs/arm_fvp_ebbr_defconfig
F: configs/iot-gate-imx8_ebbr_defconfig
F: configs/qemu_aarch64_ebbr_defconfig
@@ -3427,6 +3388,10 @@ F: support/testing/tests/package/test_zerofree.py
N: Vinicius Tinti <viniciustinti@gmail.com>
F: package/python-thrift/
N: Vivien Didelot <vivien.didelot@gmail.com>
F: board/technologic/ts5500/
F: configs/ts5500_defconfig
N: Vladimir Oltean <olteanv@gmail.com>
F: package/qoriq-ddr-phy-binary/
F: package/qoriq-firmware-inphi/
@@ -3451,11 +3416,6 @@ F: package/evilwm/
F: package/fbv/
F: package/libpam-pkcs11/
F: package/mksh/
F: package/perl-cgi/
F: package/perl-cgi-session/
F: package/perl-log-message/
F: package/perl-log-message-simple/
F: package/perl-switch/
F: package/ruby/
F: package/uclibc/
F: package/uclibc-ng-test/
@@ -3497,17 +3457,6 @@ F: boot/ti-k3-r5-loader/
F: configs/ti_am62x_sk_defconfig
F: configs/ti_am64x_sk_defconfig
N: Xukai Wang <kingxukai@zohomail.com>
F: package/python-cloudpickle/
F: package/python-farama-notifications/
F: package/python-gymnasium/
F: support/testing/tests/package/sample_python_cloudpickle.py
F: support/testing/tests/package/sample_python_farama_notifications.py
F: support/testing/tests/package/sample_python_gymnasium.py
F: support/testing/tests/package/test_python_cloudpickle.py
F: support/testing/tests/package/test_python_farama_notifications.py
F: support/testing/tests/package/test_python_gymnasium.py
N: Yair Ben Avraham <yairba@protonmail.com>
F: package/casync/
F: package/gloox/
@@ -3515,12 +3464,8 @@ F: package/tpm2-pkcs11/
N: Yann E. MORIN <yann.morin@orange.com>
F: .editorconfig
F: package/amazon-ecr-credential-helper/
F: package/docker-credential-acr-env/
F: package/docker-credential-gcr/
F: package/gpsd/
F: package/mosquitto/
F: package/python-humanfriendly/
F: package/skopeo/
N: Yegor Yefremov <yegorslists@googlemail.com>

View File

@@ -92,9 +92,9 @@ all:
.PHONY: all
# Set and export the version string
export BR2_VERSION := 2026.08-git
export BR2_VERSION := 2026.02.2
# Actual time the release is cut (for reproducible builds)
BR2_VERSION_EPOCH = 1780950000
BR2_VERSION_EPOCH = 1779278600
# Save running make version since it's clobbered by the make package
RUNNING_MAKE_VERSION := $(MAKE_VERSION)
@@ -126,7 +126,7 @@ noconfig_targets := menuconfig nconfig gconfig xconfig config oldconfig randconf
defconfig %_defconfig allyesconfig allnoconfig alldefconfig syncconfig release \
randpackageconfig allyespackageconfig allnopackageconfig \
print-version olddefconfig distclean manual manual-% check-package \
check-package-external show-info-all
check-package-external
# Some global targets do not trigger a build, but are used to collect
# metadata, or do various checks. When such targets are triggered,
@@ -142,7 +142,7 @@ nobuild_targets := source %-source \
clean distclean help show-targets graph-depends \
%-graph-depends %-show-depends %-show-version \
graph-build graph-size list-defconfigs \
savedefconfig update-defconfig printvars show-vars show-info-all
savedefconfig update-defconfig printvars show-vars
ifeq ($(MAKECMDGOALS),)
BR_BUILDING = y
else ifneq ($(filter-out $(nobuild_targets),$(MAKECMDGOALS)),)
@@ -236,13 +236,6 @@ BR2_CONFIG = $(CONFIG_DIR)/.config
ifeq ($(filter $(noconfig_targets),$(MAKECMDGOALS)),)
-include $(BR2_CONFIG)
endif
# show-info-all needs to access the PACKAGES_ALL variable. This variable
# contains a reference to every package present in Buildroot.
# Since the 'show-info-all' command might be used without actually having a
# dotconfig this condition is forced to be set true.
ifeq ($(MAKECMDGOALS),show-info-all)
BR2_HAVE_DOT_CONFIG = y
endif
ifeq ($(BR2_PER_PACKAGE_DIRECTORIES),)
# Disable top-level parallel build if per-package directories is not
@@ -941,22 +934,15 @@ check-dependencies:
$(TOPDIR)/support/scripts/graph-depends -C
.PHONY: show-info
show-info: show-info-inner
show-info: SHOW_INFO_PACKAGES = \
$(foreach i,$(PACKAGES) $(TARGETS_ROOTFS), \
$(i) $($(call UPPERCASE,$(i))_FINAL_RECURSIVE_DEPENDENCIES) \
)
.PHONY: show-info-all
show-info-all: show-info-inner
show-info-all: SHOW_INFO_PACKAGES = $(PACKAGES_ALL)
.PHONY: show-info-inner
show-info-inner:
show-info:
@:
$(info $(call clean-json, \
{ $(foreach p, \
$(sort $(SHOW_INFO_PACKAGES)), \
$(sort $(foreach i,$(PACKAGES) $(TARGETS_ROOTFS), \
$(i) \
$($(call UPPERCASE,$(i))_FINAL_RECURSIVE_DEPENDENCIES) \
) \
), \
$(call json-info,$(call UPPERCASE,$(p)))$(comma) \
) } \
) \
@@ -1227,8 +1213,6 @@ help:
@echo ' external-deps - list external packages used'
@echo ' legal-info - generate info about license compliance'
@echo ' show-info - generate info about packages, as a JSON blurb'
@echo ' show-info-all - generate info about all packages in Buildroot,'
@echo ' regardless of configuration or target architecture'
@echo ' pkg-stats - generate info about packages as JSON and HTML'
@echo ' printvars - dump internal variables selected with VARS=...'
@echo ' show-vars - dump all internal variables as a JSON blurb; use VARS=...'

View File

@@ -1,7 +1,5 @@
# Security Policy
[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/12245/badge)](https://www.bestpractices.dev/projects/12245)
## Security advisories
Advisories for Buildroot security vulnerabilities are reported on the

View File

@@ -344,10 +344,6 @@ config BR2_ARCH_NEEDS_GCC_AT_LEAST_16
bool
select BR2_ARCH_NEEDS_GCC_AT_LEAST_15
config BR2_ARCH_NEEDS_GCC_AT_LEAST_17
bool
select BR2_ARCH_NEEDS_GCC_AT_LEAST_16
# The following string values are defined by the individual
# Config.in.$ARCH files
config BR2_ARCH

View File

@@ -503,12 +503,6 @@ config BR2_tsv110
select BR2_ARCH_NEEDS_GCC_AT_LEAST_9
comment "armv8.4a cores"
config BR2_neoverse_v1
bool "neoverse-V1 (aka zeus)"
depends on BR2_ARCH_IS_64
select BR2_ARM_CPU_HAS_FP_ARMV8
select BR2_ARM_CPU_ARMV8A
select BR2_ARCH_NEEDS_GCC_AT_LEAST_11
config BR2_saphira
bool "saphira"
depends on BR2_ARCH_IS_64
@@ -529,12 +523,6 @@ config BR2_neoverse_n2
select BR2_ARM_CPU_HAS_FP_ARMV8
select BR2_ARM_CPU_ARMV9A
select BR2_ARCH_NEEDS_GCC_AT_LEAST_11
config BR2_neoverse_v2
bool "neoverse-V2 (aka demeter)"
depends on BR2_ARCH_IS_64
select BR2_ARM_CPU_HAS_FP_ARMV8
select BR2_ARM_CPU_ARMV9A
select BR2_ARCH_NEEDS_GCC_AT_LEAST_13
comment "armv9.2a cores"
config BR2_cortex_a720
@@ -543,18 +531,6 @@ config BR2_cortex_a720
select BR2_ARM_CPU_HAS_FP_ARMV8
select BR2_ARM_CPU_ARMV9A
select BR2_ARCH_NEEDS_GCC_AT_LEAST_14
config BR2_neoverse_v3
bool "neoverse-V3 (aka poseidon)"
depends on BR2_ARCH_IS_64
select BR2_ARM_CPU_HAS_FP_ARMV8
select BR2_ARM_CPU_ARMV9A
select BR2_ARCH_NEEDS_GCC_AT_LEAST_15
config BR2_neoverse_v3ae
bool "neoverse-V3AE (aka poseidon)"
depends on BR2_ARCH_IS_64
select BR2_ARM_CPU_HAS_FP_ARMV8
select BR2_ARM_CPU_ARMV9A
select BR2_ARCH_NEEDS_GCC_AT_LEAST_15
endchoice
config BR2_ARM_ENABLE_NEON
@@ -947,16 +923,12 @@ config BR2_GCC_TARGET_CPU
default "neoverse-n1" if BR2_neoverse_n1
default "tsv110" if BR2_tsv110
# armv8.4a
default "neoverse-v1" if BR2_neoverse_v1
default "saphira" if BR2_saphira
# armv9.0a
default "cortex-a710" if BR2_cortex_a710
default "neoverse-n2" if BR2_neoverse_n2
default "neoverse-v2" if BR2_neoverse_v2
# armv9.2a
default "cortex-a720" if BR2_cortex_a720
default "neoverse-v3" if BR2_neoverse_v3
default "neoverse-v3ae" if BR2_neoverse_v3ae
config BR2_GCC_TARGET_ABI
default "aapcs-linux" if BR2_arm || BR2_armeb

View File

@@ -3,6 +3,8 @@ choice
help
Architecture type (or version) to use.
config BR2_parisc10
bool "PA-RISC 1.0"
config BR2_parisc11
bool "PA-RISC 1.1"
endchoice

View File

@@ -23,11 +23,6 @@ choice
help
Specific CPU variant to use
config BR2_m68k_68000
bool "68000"
select BR2_m68k_m68k
select BR2_SOFT_FLOAT
config BR2_m68k_68030
bool "68030"
select BR2_m68k_m68k
@@ -46,7 +41,6 @@ config BR2_m68k_cf5208
endchoice
config BR2_GCC_TARGET_CPU
default "68000" if BR2_m68k_68000
default "68030" if BR2_m68k_68030
default "68040" if BR2_m68k_68040
default "5208" if BR2_m68k_cf5208

View File

@@ -144,16 +144,6 @@ config BR2_powerpc_power9
select BR2_POWERPC_CPU_HAS_ALTIVEC
select BR2_POWERPC_CPU_HAS_VSX
select BR2_ARCH_NEEDS_GCC_AT_LEAST_6
config BR2_powerpc_power10
bool "power10"
select BR2_POWERPC_CPU_HAS_ALTIVEC
select BR2_POWERPC_CPU_HAS_VSX
select BR2_ARCH_NEEDS_GCC_AT_LEAST_11
config BR2_powerpc_power11
bool "power11"
select BR2_POWERPC_CPU_HAS_ALTIVEC
select BR2_POWERPC_CPU_HAS_VSX
select BR2_ARCH_NEEDS_GCC_AT_LEAST_15
endchoice
config BR2_POWERPC_SOFT_FLOAT
@@ -217,8 +207,6 @@ config BR2_GCC_TARGET_CPU
default "power7" if BR2_powerpc_power7
default "power8" if BR2_powerpc_power8
default "power9" if BR2_powerpc_power9
default "power10" if BR2_powerpc_power10
default "power11" if BR2_powerpc_power11
config BR2_READELF_ARCH_NAME
default "PowerPC" if BR2_powerpc

View File

@@ -35,7 +35,7 @@ config BR2_X86_CPU_HAS_AVX512
# https://gcc.gnu.org/onlinedocs/gcc-13.2.0/gcc/x86-Options.html
choice
prompt "Target Architecture Variant"
default BR2_x86_i686 if BR2_i386
default BR2_x86_i586 if BR2_i386
depends on BR2_i386 || BR2_x86_64
help
Specific CPU variant to use

View File

@@ -4,7 +4,9 @@
ifeq ($(BR2_hppa),y)
ifeq ($(BR2_parisc11),y)
ifeq ($(BR2_parisc10),y)
GCC_TARGET_ARCH := 1.0
else ifeq ($(BR2_parisc11),y)
GCC_TARGET_ARCH := 1.1
endif

View File

@@ -24,7 +24,7 @@ image disk.img {
}
partition root {
partition-type-uuid = root-arm64
partition-type-uuid = b921b045-1df0-41c3-af44-4c6f280d3fae
image = "rootfs.ext2"
}
}

View File

@@ -1,3 +0,0 @@
CONFIG_BLK_DEV_PMEM=y
CONFIG_LIBNVDIMM=y
CONFIG_OF_PMEM=y

View File

@@ -1,2 +1,2 @@
# From https://www.kernel.org/pub/linux/kernel/v6.x/sha256sums.asc
sha256 8d1934a72a185f1be6b56e3ad8ea31fd9a381ffec0346c69f06c90d776da7cb8 linux-6.18.14.tar.xz
sha256 62148e7e17f54c4a5ab5e75ad4882682c54bee818948be61a5963234fc0849fc linux-6.11.11.tar.xz

View File

@@ -48,17 +48,6 @@ alternative to QEMU_EFI.fd. You will also need to change the machine
specification to "-M virt,secure=on" on qemu command line, to enable TrustZone
support, and you will need to increase the memory with "-m 1024".
HTTP boot
---------
Some U-Boot and Devicetree based firmwares are capable of booting with UEFI from
HTTP(s). [4]
The aarch64_efi_defconfig has appropriate persistent memory support compiled in
the Linux kernel to support this scenario. [5]
[1]: https://github.com/ARM-software/ebbr
[2]: https://developer.arm.com/architectures/system-architectures/arm-systemready
[3]: https://github.com/glikely/u-boot-tfa-build
[4]: https://docs.u-boot-project.org/en/latest/develop/uefi/uefi.html#uefi-http-boot-using-the-legacy-tcp-stack
[5]: https://github.com/ARM-software/edge-iot-arch-guide/blob/main/source/http-boot/pmem_node.md

View File

@@ -1,2 +1,2 @@
# From https://www.kernel.org/pub/linux/kernel/v6.x/sha256sums.asc
sha256 3712fc1ec839e4daac981176c8518912e8f452650aaedfe4381da4419613a431 linux-6.18.40.tar.xz
sha256 37f0c5d5c242c1d604e87d48f08795e861a5a85f725b4ca11d0a538f12ff8cff linux-6.18.8.tar.xz

View File

@@ -0,0 +1,36 @@
# Minimal SD card image for the Acmesystems Aria G25
image boot.vfat {
vfat {
file zImage {
image = "zImage"
}
file at91-ariag25.dtb {
image = "at91-ariag25.dtb"
}
file boot.bin {
image = "at91sam9x5_aria-sdcardboot-linux-zimage-dt-3.10.3.bin"
}
}
size = 16M
}
image sdcard.img {
hdimage {
}
partition boot {
partition-type = 0xC
bootable = "true"
image = "boot.vfat"
}
partition rootfs {
partition-type = 0x83
image = "rootfs.ext4"
size = 512M
}
}

View File

@@ -0,0 +1,2 @@
# Locally calculated
sha256 5ea2a8fed1ba0024229c6f6d77176679e1b24791bdbce8e285634013d4a93551 at91bootstrap3-v3.10.3-git4.tar.gz

View File

@@ -0,0 +1,2 @@
# Locally calculated
sha256 6c5e4d3c87feadbfdb9f7d2e46f3f120b00286ba380491c5956708e0b94232c8 linux-4.19.315.tar.xz

View File

@@ -0,0 +1,44 @@
Acme Systems Aria G25
Build instructions
==================
To build an image for the Aria G25 choose the configuration
corresponding to the Aria variant.
For 128MB RAM variant type:
$ make acmesystems_aria_g25_128mb_defconfig
else for 256MB RAM variant type:
$ make acmesystems_aria_g25_256mb_defconfig
To customize the configuration choosed type:
$ make menuconfig
When you are ready to start building Buildroot type:
$ make
How to write the microSD card
=============================
Once the build process is finished you will have an image called
"sdcard.img" in the output/images/ directory.
Write the bootable SD card image "sdcard.img" onto an SD card with
"dd" command:
$ sudo dd if=output/images/sdcard.img of=/dev/sdX
Assuming your Aria G25 baseboard has a MicroSD socket, for example
with the Terra baseboard, insert the microSD card into the baseboard
slot and power it.
To get the kernel log messages you can use a DPI cable
(http://www.acmesystems.it/DPI)
You can find additional informations, tutorials and a very
comprehensive documentation on http://www.acmesystems.it/aria.

View File

@@ -0,0 +1,36 @@
# Minimal SD card image for the Acmesystems Arietta G25
image boot.vfat {
vfat {
file zImage {
image = "zImage"
}
file acme-arietta.dtb {
image = "at91-ariettag25.dtb"
}
file boot.bin {
image = "at91sam9x5_arietta-sdcardboot-linux-zimage-dt-3.10.3.bin"
}
}
size = 16M
}
image sdcard.img {
hdimage {
}
partition boot {
partition-type = 0xC
bootable = "true"
image = "boot.vfat"
}
partition rootfs {
partition-type = 0x83
image = "rootfs.ext4"
size = 512M
}
}

View File

@@ -0,0 +1,2 @@
# Locally calculated
sha256 5ea2a8fed1ba0024229c6f6d77176679e1b24791bdbce8e285634013d4a93551 at91bootstrap3-v3.10.3-git4.tar.gz

View File

@@ -0,0 +1,2 @@
# Locally calculated
sha256 6c5e4d3c87feadbfdb9f7d2e46f3f120b00286ba380491c5956708e0b94232c8 linux-4.19.315.tar.xz

View File

@@ -0,0 +1,49 @@
Acme Systems Arietta G25
Intro
=====
This default configuration will allow you to start experimenting with the
buildroot environment for the Arietta G25. With the current configuration
it will bring-up the board, and allow access through the serial console.
You can find additional informations, tutorials and a very comprehensive
documentation on http://www.acmesystems.it/arietta.
Build instructions
==================
To build an image for the Arietta G25 choose the configuration
corresponding to the Arietta variant.
For 128MB RAM variant type:
$ make acmesystems_arietta_g25_128mb_defconfig
else for 256MB RAM variant type:
$ make acmesystems_arietta_g25_256mb_defconfig
To customize the configuration chosen type:
$ make menuconfig
When you are ready to start building Buildroot type:
$ make
How to write the microSD card
=============================
Once the build process is finished you will have an image called "sdcard.img"
in the output/images/ directory.
Copy the bootable "sdcard.img" onto an SD card with "dd":
$ sudo dd if=output/images/sdcard.img of=/dev/sdX
Insert the microSD card into the Arietta slot and power it.
The image just built is fairly basic and the only output
you will get is on serial console, please consider to use a DPI
cable (http://www.acmesystems.it/DPI)

View File

@@ -1,2 +0,0 @@
# Locally calculated
sha256 5ad0192e5cd10eca5f9fabb3234f2bfcbafba3382a9577139cc66be629e5bafa linux-v20190618.tar.gz

View File

@@ -1,2 +0,0 @@
# Locally calculated
sha256 eba8aaf634affec7c27a55b899c404a85a0c219c3f814d576793e3c21b711b05 uboot-v20190618.tar.gz

View File

@@ -0,0 +1,247 @@
/*
* Device Tree Generator version: 1.3
*
* (C) Copyright 2007-2008 Xilinx, Inc.
* (C) Copyright 2007-2009 Michal Simek
*
* Michal SIMEK <monstr@monstr.eu>
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License as
* published by the Free Software Foundation; either version 2 of
* the License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place, Suite 330, Boston,
* MA 02111-1307 USA
*
* CAUTION: This file is automatically generated by libgen.
* Version: Xilinx EDK 13.2 EDK_O.61xd
*
* XPS project directory: device-tree_bsp_230-orig
*/
/dts-v1/;
/ {
#address-cells = <1>;
#size-cells = <1>;
compatible = "xlnx,microblaze";
model = "testing";
MCB3_LPDDR: memory@80000000 {
device_type = "memory";
reg = < 0x80000000 0x4000000 >;
} ;
aliases {
ethernet0 = &Ethernet_MAC;
serial0 = &USB_Uart;
} ;
chosen {
bootargs = "console=ttyUL0";
linux,stdout-path = "/axi@0/serial@40600000";
} ;
cpus {
#address-cells = <1>;
#cpus = <0x1>;
#size-cells = <0>;
microblaze_0: cpu@0 {
clock-frequency = <66666667>;
compatible = "xlnx,microblaze-8.20.a";
d-cache-baseaddr = <0x80000000>;
d-cache-highaddr = <0x83ffffff>;
d-cache-line-size = <0x10>;
d-cache-size = <0x2000>;
device_type = "cpu";
i-cache-baseaddr = <0x80000000>;
i-cache-highaddr = <0x83ffffff>;
i-cache-line-size = <0x10>;
i-cache-size = <0x2000>;
model = "microblaze,8.20.a";
reg = <0>;
timebase-frequency = <66666667>;
xlnx,addr-tag-bits = <0xd>;
xlnx,allow-dcache-wr = <0x1>;
xlnx,allow-icache-wr = <0x1>;
xlnx,area-optimized = <0x0>;
xlnx,avoid-primitives = <0x0>;
xlnx,branch-target-cache-size = <0x0>;
xlnx,cache-byte-size = <0x2000>;
xlnx,d-axi = <0x1>;
xlnx,d-lmb = <0x1>;
xlnx,d-plb = <0x0>;
xlnx,data-size = <0x20>;
xlnx,dcache-addr-tag = <0xd>;
xlnx,dcache-always-used = <0x1>;
xlnx,dcache-byte-size = <0x2000>;
xlnx,dcache-data-width = <0x0>;
xlnx,dcache-force-tag-lutram = <0x0>;
xlnx,dcache-interface = <0x0>;
xlnx,dcache-line-len = <0x4>;
xlnx,dcache-use-fsl = <0x0>;
xlnx,dcache-use-writeback = <0x0>;
xlnx,dcache-victims = <0x0>;
xlnx,debug-enabled = <0x1>;
xlnx,div-zero-exception = <0x0>;
xlnx,dynamic-bus-sizing = <0x1>;
xlnx,ecc-use-ce-exception = <0x0>;
xlnx,edge-is-positive = <0x1>;
xlnx,endianness = <0x1>;
xlnx,family = "spartan6";
xlnx,fault-tolerant = <0x0>;
xlnx,fpu-exception = <0x0>;
xlnx,freq = <0x3f940ab>;
xlnx,fsl-data-size = <0x20>;
xlnx,fsl-exception = <0x0>;
xlnx,fsl-links = <0x0>;
xlnx,i-axi = <0x0>;
xlnx,i-lmb = <0x1>;
xlnx,i-plb = <0x0>;
xlnx,icache-always-used = <0x1>;
xlnx,icache-data-width = <0x0>;
xlnx,icache-force-tag-lutram = <0x0>;
xlnx,icache-interface = <0x0>;
xlnx,icache-line-len = <0x4>;
xlnx,icache-streams = <0x0>;
xlnx,icache-use-fsl = <0x0>;
xlnx,icache-victims = <0x0>;
xlnx,ill-opcode-exception = <0x0>;
xlnx,instance = "microblaze_0";
xlnx,interconnect = <0x2>;
xlnx,interconnect-m-axi-dc-aw-register = <0x0>;
xlnx,interconnect-m-axi-dc-read-issuing = <0x2>;
xlnx,interconnect-m-axi-dc-w-register = <0x0>;
xlnx,interconnect-m-axi-dc-write-issuing = <0x20>;
xlnx,interconnect-m-axi-dp-read-issuing = <0x1>;
xlnx,interconnect-m-axi-dp-write-issuing = <0x1>;
xlnx,interconnect-m-axi-ic-read-issuing = <0x2>;
xlnx,interconnect-m-axi-ip-read-issuing = <0x1>;
xlnx,interrupt-is-edge = <0x0>;
xlnx,lockstep-slave = <0x0>;
xlnx,mmu-dtlb-size = <0x1>;
xlnx,mmu-itlb-size = <0x1>;
xlnx,mmu-privileged-instr = <0x0>;
xlnx,mmu-tlb-access = <0x3>;
xlnx,mmu-zones = <0x2>;
xlnx,number-of-pc-brk = <0x1>;
xlnx,number-of-rd-addr-brk = <0x0>;
xlnx,number-of-wr-addr-brk = <0x0>;
xlnx,opcode-0x0-illegal = <0x0>;
xlnx,optimization = <0x0>;
xlnx,pvr = <0x0>;
xlnx,pvr-user1 = <0x0>;
xlnx,pvr-user2 = <0x0>;
xlnx,reset-msr = <0x0>;
xlnx,sco = <0x0>;
xlnx,stream-interconnect = <0x0>;
xlnx,unaligned-exceptions = <0x0>;
xlnx,use-barrel = <0x1>;
xlnx,use-branch-target-cache = <0x0>;
xlnx,use-dcache = <0x1>;
xlnx,use-div = <0x0>;
xlnx,use-ext-brk = <0x1>;
xlnx,use-ext-nm-brk = <0x1>;
xlnx,use-extended-fsl-instr = <0x0>;
xlnx,use-fpu = <0x0>;
xlnx,use-hw-mul = <0x1>;
xlnx,use-icache = <0x1>;
xlnx,use-interrupt = <0x1>;
xlnx,use-mmu = <0x3>;
xlnx,use-msr-instr = <0x1>;
xlnx,use-pcmp-instr = <0x0>;
xlnx,use-stack-protection = <0x0>;
} ;
} ;
axi4lite_0: axi@0 {
#address-cells = <1>;
#size-cells = <1>;
compatible = "xlnx,axi-interconnect-1.03.a", "simple-bus";
ranges ;
Ethernet_MAC: ethernet@40e00000 {
compatible = "xlnx,axi-ethernetlite-1.00.a", "xlnx,xps-ethernetlite-1.00.a";
device_type = "network";
interrupt-parent = <&microblaze_0_intc>;
interrupts = < 2 0 >;
local-mac-address = [ 00 0a 35 aa de 00 ];
// phy-handle = <&phy0>;
reg = < 0x40e00000 0x10000 >;
xlnx,duplex = <0x1>;
xlnx,family = "spartan6";
xlnx,include-global-buffers = <0x0>;
xlnx,include-internal-loopback = <0x0>;
xlnx,include-mdio = <0x1>;
xlnx,include-phy-constraints = <0x1>;
xlnx,interconnect-s-axi-read-acceptance = <0x1>;
xlnx,interconnect-s-axi-write-acceptance = <0x1>;
xlnx,rx-ping-pong = <0x0>;
xlnx,s-axi-aclk-period-ps = <0x3a98>;
xlnx,s-axi-id-width = <0x1>;
xlnx,s-axi-supports-narrow-burst = <0x0>;
xlnx,tx-ping-pong = <0x0>;
/*
mdio {
#address-cells = <1>;
#size-cells = <0>;
phy0: phy@7 {
compatible = "marvell,88e1111";
device_type = "ethernet-phy";
reg = <7>;
} ;
} ;
*/
} ;
SPI_FLASH: spi@40a00000 {
compatible = "xlnx,axi-spi-1.01.a", "xlnx,xps-spi-2.00.a";
interrupt-parent = <&microblaze_0_intc>;
interrupts = < 1 2 >;
reg = < 0x40a00000 0x10000 >;
xlnx,family = "spartan6";
xlnx,fifo-exist = <0x1>;
xlnx,num-ss-bits = <0x1>;
xlnx,num-transfer-bits = <0x8>;
xlnx,sck-ratio = <0x4>;
} ;
USB_Uart: serial@40600000 {
clock-frequency = <66666667>;
compatible = "xlnx,axi-uartlite-1.02.a", "xlnx,xps-uartlite-1.00.a";
current-speed = <115200>;
device_type = "serial";
interrupt-parent = <&microblaze_0_intc>;
interrupts = < 3 0 >;
port-number = <0>;
reg = < 0x40600000 0x10000 >;
xlnx,baudrate = <0x1c200>;
xlnx,data-bits = <0x8>;
xlnx,family = "spartan6";
xlnx,odd-parity = <0x1>;
xlnx,s-axi-aclk-freq-hz = <0x3f940ab>;
xlnx,use-parity = <0x0>;
} ;
microblaze_0_intc: interrupt-controller@41200000 {
#interrupt-cells = <0x2>;
compatible = "xlnx,axi-intc-1.01.a", "xlnx,xps-intc-1.00.a";
interrupt-controller ;
reg = < 0x41200000 0x10000 >;
xlnx,kind-of-intr = <0xc>;
xlnx,num-intr-inputs = <0x4>;
} ;
system_timer: timer@41c00000 {
clock-frequency = <66666667>;
compatible = "xlnx,axi-timer-1.02.a", "xlnx,xps-timer-1.00.a";
interrupt-parent = <&microblaze_0_intc>;
interrupts = < 0 2 >;
reg = < 0x41c00000 0x10000 >;
xlnx,count-width = <0x20>;
xlnx,family = "spartan6";
xlnx,gen0-assert = <0x1>;
xlnx,gen1-assert = <0x1>;
xlnx,one-timer-only = <0x0>;
xlnx,trig0-assert = <0x1>;
xlnx,trig1-assert = <0x1>;
} ;
} ;
} ;

View File

@@ -0,0 +1,68 @@
CONFIG_EXPERIMENTAL=y
CONFIG_SYSVIPC=y
CONFIG_IKCONFIG=y
CONFIG_IKCONFIG_PROC=y
CONFIG_BLK_DEV_INITRD=y
CONFIG_INITRAMFS_SOURCE="rootfs.cpio"
CONFIG_INITRAMFS_COMPRESSION_GZIP=y
# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
CONFIG_EXPERT=y
CONFIG_KALLSYMS_ALL=y
CONFIG_KALLSYMS_EXTRA_PASS=y
# CONFIG_HOTPLUG is not set
# CONFIG_BASE_FULL is not set
# CONFIG_FUTEX is not set
# CONFIG_EPOLL is not set
# CONFIG_SIGNALFD is not set
# CONFIG_SHMEM is not set
CONFIG_SLAB=y
CONFIG_MODULES=y
CONFIG_MODULE_UNLOAD=y
# CONFIG_BLK_DEV_BSG is not set
# CONFIG_OPT_LIB_ASM is not set
CONFIG_KERNEL_BASE_ADDR=0x80000000
CONFIG_XILINX_MICROBLAZE0_FAMILY="spartan6"
CONFIG_XILINX_MICROBLAZE0_USE_MSR_INSTR=1
# CONFIG_XILINX_MICROBLAZE0_USE_PCMP_INSTR is not set
CONFIG_XILINX_MICROBLAZE0_USE_BARREL=1
CONFIG_XILINX_MICROBLAZE0_USE_HW_MUL=1
CONFIG_XILINX_MICROBLAZE0_HW_VER="8.20.a"
CONFIG_HZ_100=y
CONFIG_MMU=y
CONFIG_CMDLINE_BOOL=y
CONFIG_CMDLINE_FORCE=y
CONFIG_NET=y
CONFIG_PACKET=y
CONFIG_UNIX=y
CONFIG_INET=y
# CONFIG_INET_LRO is not set
# CONFIG_IPV6 is not set
CONFIG_PROC_DEVICETREE=y
CONFIG_BLK_DEV_RAM=y
CONFIG_BLK_DEV_RAM_SIZE=8192
CONFIG_NETDEVICES=y
CONFIG_NET_ETHERNET=y
CONFIG_XILINX_EMACLITE=y
# CONFIG_INPUT is not set
# CONFIG_SERIO is not set
# CONFIG_VT is not set
CONFIG_SERIAL_UARTLITE=y
CONFIG_SERIAL_UARTLITE_CONSOLE=y
# CONFIG_HW_RANDOM is not set
# CONFIG_HWMON is not set
# CONFIG_USB_SUPPORT is not set
CONFIG_EXT2_FS=y
# CONFIG_DNOTIFY is not set
CONFIG_NFS_FS=y
CONFIG_NFS_V3=y
CONFIG_CIFS=y
CONFIG_CIFS_STATS=y
CONFIG_CIFS_STATS2=y
CONFIG_PARTITION_ADVANCED=y
CONFIG_DEBUG_KERNEL=y
CONFIG_DETECT_HUNG_TASK=y
CONFIG_DEBUG_SLAB=y
CONFIG_DEBUG_SPINLOCK=y
CONFIG_DEBUG_INFO=y
CONFIG_EARLY_PRINTK=y
# CONFIG_CRYPTO_ANSI_CPRNG is not set

View File

@@ -0,0 +1,70 @@
This is the buildroot board support for the Avnet Spartan6 LX9 MicroBoard.
The Avnet S6LX9 Microboard is a small USB-Stick sized module containing
a Spartan6 FPGA capable of running the Microblaze softcore processor
together with RAM and FLASH memory.
The board can be bought from Avnet (avnet.com) or from Trenz Electronic
(www.trenz-electronic.de) for a low price.
To run the Linux built with buildroot you have to install the FPGA bitfile
and u-boot as described in the tutorial AvtS6LX9MicroBoard_SW302_PetaLinux
available on http://www.em.avnet.com/s6microboard
On this site also is a forum containing information on how to build your own
Microblaze processor for the Microboard.
The image file (default name is simpleImage.lx9_mmu.ub) has to be copied
to your tftp folder (often /tftpboot/) or can be programmed into the
board's SPI flash.
Sample session:
$ make s6lx9_microboard_defconfig
$ make
$ cp build/linux-<version>/arch/microblaze/boot/simpleImage.lx9_mmu.ub /tftpboot/br12.2a.ub
$ minicom
<hit the reset button on the S6LX9 Microboard>
Icache:ON
Dcache:ON
U-Boot Start:0x83f00000
SF: Got idcode 20 ba 18 10 01
*** Warning - bad CRC, using default environment
Net: Xilinx_Emaclite
MAC: 00:0a:35:00:63:37
U-BOOT for Avnet-LX9-Microboard-AXI-tiny-13.1
BOOTP broadcast 1
DHCP client bound to address 192.168.11.122
Hit any key to stop autoboot: 0
U-Boot-PetaLinux> tftp br12.2a.ub
Using Xilinx_Emaclite device
TFTP from server 192.168.11.10; our IP address is 192.168.11.122
Filename 'br12.2a.ub'.
Load address: 0x80002000
Loading: #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
##############################
done
Bytes transferred = 5207724 (4f76ac hex)
U-Boot-PetaLinux> bootm
## Booting kernel from Legacy Image at 80002000 ...
Image Name: Linux-3.1.0
Image Type: MicroBlaze Linux Kernel Image (uncompressed)
Data Size: 5207660 Bytes = 5 MB
Load Address: 80000000
Entry Point: 80000000
Verifying Checksum ... OK
Loading Kernel Image ... OK
OK
## Transferring control to Linux (at address 80000000), 0x80000000 ramdisk 0x00000000, FDT 0x00000000...
Early console on uartlite at 0x40600000
..... boot log skipped
Welcome to Microblaze Buildroot
Microblaze login:

View File

@@ -1,2 +1,2 @@
# From https://cdn.kernel.org/pub/linux/kernel/v6.x/sha256sums.asc
sha256 ac26e508abd56e9f8b89872b6e10c49fc823bcc70d8068a5d8504c1a7c4ff045 linux-6.18.38.tar.xz
sha256 d0a78bf3f0d12aaa10af3b5adcaed5bc767b5b78705e5ef885d5e930b72e25d5 linux-6.18.1.tar.xz

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 78e8bfc382fe388f9b55aa1daf8c563522a037779b5d4c349d1415e381f1243e u-boot-2026.07.tar.bz2
sha256 b60d5865cefdbc75da8da4156c56c458e00de75a49b80c1a2e58a96e30ad0d54 u-boot-2026.01.tar.bz2

View File

@@ -0,0 +1,2 @@
# Locally calculated
sha256 7efa89e1b4e4106ee05d68e876c8efbb146364d89cfd5d26bf4647b09c08f32b arm-trusted-firmware-v2.10-git4.tar.gz

View File

@@ -1,2 +1,2 @@
# From https://www.kernel.org/pub/linux/kernel/v6.x/sha256sums.asc
sha256 4f21c01f4d04c1d1b3ed794153f8900802c92497be620b07c4869530f2d28ee3 linux-6.18.16.tar.xz
sha256 9b4ccec7d8ceff4824f149e476ec06e83c86546ae8af82582871647809a62ef0 linux-6.12.70.tar.xz

View File

@@ -0,0 +1,2 @@
# Locally calculated
sha256 c0f23ccc71c49989e9ad238acf334473c17b7c88f79a20c829c3d443e3794a22 arm-trusted-firmware-v2.11-git4.tar.gz

View File

@@ -0,0 +1 @@
../linux/linux.hash

View File

@@ -1,2 +1,2 @@
# From https://www.kernel.org/pub/linux/kernel/v6.x/sha256sums.asc
sha256 4f21c01f4d04c1d1b3ed794153f8900802c92497be620b07c4869530f2d28ee3 linux-6.18.16.tar.xz
# Locally calculated
sha256 774698422ee54c5f1e704456f37c65c06b51b4e9a8b0866f34580d86fef8e226 linux-6.10.tar.xz

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 b60d5865cefdbc75da8da4156c56c458e00de75a49b80c1a2e58a96e30ad0d54 u-boot-2026.01.tar.bz2
sha256 f591da9ab90ef3d6b3d173766d0ddff90c4ed7330680897486117df390d83c8f u-boot-2024.07.tar.bz2

View File

@@ -0,0 +1 @@
../linux/linux.hash

View File

@@ -1,2 +1,2 @@
# From https://www.kernel.org/pub/linux/kernel/v6.x/sha256sums.asc
sha256 4f21c01f4d04c1d1b3ed794153f8900802c92497be620b07c4869530f2d28ee3 linux-6.18.16.tar.xz
# Locally calculated
sha256 2bb586c954277d070c8fdf6d7275faa93b4807d9bf3353b491d8149cca02b4fc linux-6.15.6.tar.xz

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 b60d5865cefdbc75da8da4156c56c458e00de75a49b80c1a2e58a96e30ad0d54 u-boot-2026.01.tar.bz2
sha256 0f933f6c5a426895bf306e93e6ac53c60870e4b54cda56d95211bec99e63bec7 u-boot-2025.07.tar.bz2

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 b60d5865cefdbc75da8da4156c56c458e00de75a49b80c1a2e58a96e30ad0d54 u-boot-2026.01.tar.bz2
sha256 0f933f6c5a426895bf306e93e6ac53c60870e4b54cda56d95211bec99e63bec7 u-boot-2025.07.tar.bz2

View File

@@ -1,2 +1,2 @@
# From https://cdn.kernel.org/pub/linux/kernel/v6.x/sha256sums.asc
sha256 7d2e1b5d5ab36b3a01856e71782dad2a54e634fb2b37c0a42998def3bbf957c1 linux-6.12.96.tar.xz
sha256 d1ad94a33681148efe884f4028970d69e332f2b003f0e8be53a1d25de38e49a2 linux-6.12.64.tar.xz

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 78e8bfc382fe388f9b55aa1daf8c563522a037779b5d4c349d1415e381f1243e u-boot-2026.07.tar.bz2
sha256 b60d5865cefdbc75da8da4156c56c458e00de75a49b80c1a2e58a96e30ad0d54 u-boot-2026.01.tar.bz2

View File

@@ -1,2 +1,2 @@
# From https://www.kernel.org/pub/linux/kernel/v6.x/sha256sums.asc
sha256 7d2e1b5d5ab36b3a01856e71782dad2a54e634fb2b37c0a42998def3bbf957c1 linux-6.12.96.tar.xz
sha256 d1ad94a33681148efe884f4028970d69e332f2b003f0e8be53a1d25de38e49a2 linux-6.12.64.tar.xz

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 78e8bfc382fe388f9b55aa1daf8c563522a037779b5d4c349d1415e381f1243e u-boot-2026.07.tar.bz2
sha256 b60d5865cefdbc75da8da4156c56c458e00de75a49b80c1a2e58a96e30ad0d54 u-boot-2026.01.tar.bz2

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 b60d5865cefdbc75da8da4156c56c458e00de75a49b80c1a2e58a96e30ad0d54 u-boot-2026.01.tar.bz2
sha256 0f933f6c5a426895bf306e93e6ac53c60870e4b54cda56d95211bec99e63bec7 u-boot-2025.07.tar.bz2

View File

@@ -0,0 +1 @@
../linux/linux.hash

View File

@@ -1,2 +1,2 @@
# From https://www.kernel.org/pub/linux/kernel/v7.x/sha256sums.asc
sha256 be41c068e88f5242a19bccdbffbe077b18c47b45f627e2325504b4fab79dd1dc linux-7.1.3.tar.xz
# Locally calculated
sha256 b4850cf670a032c70f38b713a27d62046c5f747caf028c5f50b18f98606a9eb1 linux-6.12.52.tar.xz

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 78e8bfc382fe388f9b55aa1daf8c563522a037779b5d4c349d1415e381f1243e u-boot-2026.07.tar.bz2
sha256 b4f032848e56cc8f213ad59f9132c084dbbb632bc29176d024e58220e0efdf4a u-boot-2025.10.tar.bz2

View File

@@ -0,0 +1 @@
../linux/linux.hash

View File

@@ -1,2 +1,2 @@
# From https://www.kernel.org/pub/linux/kernel/v7.x/sha256sums.asc
sha256 be41c068e88f5242a19bccdbffbe077b18c47b45f627e2325504b4fab79dd1dc linux-7.1.3.tar.xz
# Locally calculated
sha256 b4850cf670a032c70f38b713a27d62046c5f747caf028c5f50b18f98606a9eb1 linux-6.12.52.tar.xz

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 78e8bfc382fe388f9b55aa1daf8c563522a037779b5d4c349d1415e381f1243e u-boot-2026.07.tar.bz2
sha256 b4f032848e56cc8f213ad59f9132c084dbbb632bc29176d024e58220e0efdf4a u-boot-2025.10.tar.bz2

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 6fd749e53c455aec3418288630544e7552bbffab4442ddc48b20ebef9aee87ff arm-trusted-firmware-v2.14-git4.tar.gz
sha256 c0f23ccc71c49989e9ad238acf334473c17b7c88f79a20c829c3d443e3794a22 arm-trusted-firmware-v2.11-git4.tar.gz

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 f4855f382c1b735c84072bdef36db5bcd5dc7b0c37e42f5104317149a0a486ef linux-6.18.18.tar.xz
sha256 f74812f78e88992c416434cb107639e13a551dbaff36bb90d6346ab16ab71a95 linux-6.6.56.tar.xz

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 b60d5865cefdbc75da8da4156c56c458e00de75a49b80c1a2e58a96e30ad0d54 u-boot-2026.01.tar.bz2
sha256 f591da9ab90ef3d6b3d173766d0ddff90c4ed7330680897486117df390d83c8f u-boot-2024.07.tar.bz2

View File

@@ -1 +0,0 @@
CONFIG_IMX_SDMA=m

View File

@@ -1,2 +0,0 @@
# Locally calculated
sha256 37f0c5d5c242c1d604e87d48f08795e861a5a85f725b4ca11d0a538f12ff8cff linux-6.18.8.tar.xz

View File

@@ -1,2 +0,0 @@
# Locally calculated
sha256 b60d5865cefdbc75da8da4156c56c458e00de75a49b80c1a2e58a96e30ad0d54 u-boot-2026.01.tar.bz2

View File

@@ -1,64 +0,0 @@
****************************
Freescale i.MX6ULL EVK board
****************************
This file documents the Buildroot support for the Freescale i.MX6ULL EVK board
using Upstream U-Boot and Linux.
Build
=====
First, configure Buildroot for your i.MX6ULL EVK board:
In order to do so issue:
make imx6ullevk_defconfig
Build all components:
make
You will find in output/images/ the following files:
- boot.vfat
- imx6ull-14x14-evk.dtb
- rootfs.ext2
- rootfs.ext4
- rootfs.tar
- sdcard.img
- u-boot.bin
- u-boot-dtb.imx
- zImage
Create a bootable SD card
=========================
To determine the device associated to the SD card have a look in the
/proc/partitions file:
cat /proc/partitions
Buildroot prepares a bootable "sdcard.img" image in the output/images/
directory, ready to be dumped on a SD card. Launch the following
command as root:
dd if=./output/images/sdcard.img of=/dev/<your-sd-device>
*** WARNING! This will destroy all the card content. Use with care! ***
For details about the medium image layout, see the definition in
board/freescale/common/imx/genimage.cfg.template.
Boot the i.MX6ULL EVK board
===========================
To boot your newly created system (refer to the i.MX 6ULL EVK Quick Start Guide [1] for guidance):
- insert the SD card in the micro SD slot of the board;
- put a micro USB cable into the Debug USB Port and connect using a terminal
emulator at 115200 bps, 8n1;
- power on the board.
Enjoy!
References
==========
[1] https://www.nxp.com/webapp/Download?colCode=IMX6ULLQSG

View File

@@ -2,18 +2,25 @@
Freescale i.MX6ULL EVK board
****************************
This file documents the Buildroot support for the Freescale i.MX6ULL EVK board
using Vendor U-Boot and Linux.
This file documents the Buildroot support for the Freescale i.MX6ULL EVK board.
Build
=====
First, configure Buildroot for your i.MX6ULL EVK board:
In order to do so issue:
In order to do so there are two supported options:
make freescale_imx6ullevk_defconfig
if you plan to use NXP provided U-Boot and kernel.
or
make imx6ullevk_defconfig
if you plan to use mainline U-Boot and mainline kernel.
Build all components:
make

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 d7813f4ad5431edb162d6be2775bc021f9007b9c6934e977330291168523a507 imx-atf-lf-6.18.20-2.0.0.tar.gz
sha256 8cfe0afc903ebbc03f27e4874aa9ce82be78843a8b42ed4c906871e7f311b510 imx-atf-lf-6.6.36-2.1.0.tar.gz

View File

@@ -0,0 +1 @@
../linux/linux.hash

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 a8f55764fd1418db8adfd2711c0abb7d5464a8ee1cbfd0f6878f1059ecfa1316 linux-imx-lf-6.18.20-2.0.0.tar.gz
sha256 3f5017e85ba6c490be597670033a7eaba14e3c34af4e53d24dc3762c3deece83 linux-imx-lf-6.6.36-2.1.0-imx91frdm.tar.gz

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 96942f8c49736b7d40277891bf0a34cfdd0afb59390f79b65b2b33b3bbd19f61 uboot-imx-lf-6.18.20-2.0.0.tar.gz
sha256 f7d9a6e99825926d0bc597e0fdfeafffcc76ad6267f1d4e9aae1fe9a8d400c22 uboot-imx-lf-6.6.36-2.1.0-imx91frdm.tar.gz

View File

@@ -1 +0,0 @@
# CONFIG_EFI_CAPSULE_AUTHENTICATE is not set

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 d7813f4ad5431edb162d6be2775bc021f9007b9c6934e977330291168523a507 imx-atf-lf-6.18.20-2.0.0.tar.gz
sha256 8cfe0afc903ebbc03f27e4874aa9ce82be78843a8b42ed4c906871e7f311b510 imx-atf-lf-6.6.36-2.1.0.tar.gz

View File

@@ -0,0 +1 @@
../linux/linux.hash

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 a8f55764fd1418db8adfd2711c0abb7d5464a8ee1cbfd0f6878f1059ecfa1316 linux-imx-lf-6.18.20-2.0.0.tar.gz
sha256 3244dc3c62c990d9de90e1c7193aa3099e0e74e720de5c9c13edfbfdd802f596 linux-imx-lf-6.6.36-2.1.0-imx93frdm.tar.gz

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 96942f8c49736b7d40277891bf0a34cfdd0afb59390f79b65b2b33b3bbd19f61 uboot-imx-lf-6.18.20-2.0.0.tar.gz
sha256 bced4334363199d5465532d221d06dc3a5b49271067d74408019c825ed2ca715 uboot-imx-lf-6.6.36-2.1.0-imx93frdm.tar.gz

View File

@@ -1 +0,0 @@
# CONFIG_EFI_CAPSULE_AUTHENTICATE is not set

View File

@@ -1,2 +1,2 @@
# From https://www.kernel.org/pub/linux/kernel/v6.x/sha256sums.asc
sha256 f4855f382c1b735c84072bdef36db5bcd5dc7b0c37e42f5104317149a0a486ef linux-6.18.18.tar.xz
sha256 0fcbbbbcd456e87bbbfc8bf37af541fda62ccfcce76903503424fd101ef7bdee linux-6.12.43.tar.xz

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 b60d5865cefdbc75da8da4156c56c458e00de75a49b80c1a2e58a96e30ad0d54 u-boot-2026.01.tar.bz2
sha256 0f933f6c5a426895bf306e93e6ac53c60870e4b54cda56d95211bec99e63bec7 u-boot-2025.07.tar.bz2

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 658af40a90fd8e2460d364775a0c37e0507201e49de7f69c8a22d61e179f81e1 atf-lf-6.18.20-2.0.0.tar.gz
sha256 2d3f9c52e16766c290bdc0bc130d634e4c326a5b236dfb2f2ca3f0fa457e82d4 atf-lf-6.12.34-2.1.0.tar.gz

View File

@@ -1,2 +1,2 @@
# Locally computed
sha256 206f997d41bb958099bf7a89a02a6889942b118984f81f9a45bec9907f60708f linux-lf-6.18.20-2.0.0.tar.gz
sha256 27a1987ca0a5802d3ebb296b8134ec66d813ad86cf2a60779b45092735bbb23b linux-lf-6.12.34-2.1.0.tar.gz

View File

@@ -1,2 +1,2 @@
# Locally computed
sha256 04aed627132db7b656117c7a35fb29d314172319fa3a297ea6748eebac2b5ce3 u-boot-lf-6.18.20-2.0.0.tar.gz
sha256 2f25cde388b2f83ff7a8e3afe25aafb1db48dafb0fa3bf1e4f9fef603f3b4785 u-boot-lf-6.12.34-2.1.0.tar.gz

View File

@@ -11,7 +11,7 @@ For more details about the board and the QorIQ Layerscape SoC, see the following
Layerscape platforms are officially supported by NXP under the Layerscape
Debian Linux SDK (LDLSDK). This uses components from Linux Factory (project
common with i.MX), but has a slower release cadence than LF. The currently used
tag is lf-6.18.20-2.0.0, which is in line with the latest LF tag. Generally, in
tag is lf-6.12.34-2.1.0, which is in line with the latest LF tag. Generally, in
Buildroot, the latest Linux Factory release tag is always used, which may be
considered pre-release software, as it may contain features which are not yet
documented, and it generally undergoes less testing.
@@ -21,11 +21,11 @@ For the software Layerscape Debian Linux SDK User Guide, see:
- https://www.nxp.com/docs/en/user-guide/UG10143.pdf
The components from NXP are:
- rcw, lf-6.18.20-2.0.0
- atf (fork), lf-6.18.20-2.0.0
- uboot (fork), lf-6.18.20-2.0.0
- rcw, lf-6.12.34-2.1.0
- atf (fork), lf-6.12.34-2.1.0
- uboot (fork), lf-6.12.34-2.1.0
- cadence-dp-firmware (blob), 8.16
- linux (fork), lf-6.18.20-2.0.0
- linux (fork), lf-6.12.34-2.1.0
Build
=====

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 658af40a90fd8e2460d364775a0c37e0507201e49de7f69c8a22d61e179f81e1 atf-lf-6.18.20-2.0.0.tar.gz
sha256 2d3f9c52e16766c290bdc0bc130d634e4c326a5b236dfb2f2ca3f0fa457e82d4 atf-lf-6.12.34-2.1.0.tar.gz

View File

@@ -1,2 +1,2 @@
# Locally computed
sha256 206f997d41bb958099bf7a89a02a6889942b118984f81f9a45bec9907f60708f linux-lf-6.18.20-2.0.0.tar.gz
sha256 27a1987ca0a5802d3ebb296b8134ec66d813ad86cf2a60779b45092735bbb23b linux-lf-6.12.34-2.1.0.tar.gz

View File

@@ -1,2 +1,2 @@
# Locally computed
sha256 04aed627132db7b656117c7a35fb29d314172319fa3a297ea6748eebac2b5ce3 u-boot-lf-6.18.20-2.0.0.tar.gz
sha256 2f25cde388b2f83ff7a8e3afe25aafb1db48dafb0fa3bf1e4f9fef603f3b4785 u-boot-lf-6.12.34-2.1.0.tar.gz

View File

@@ -11,7 +11,7 @@ for more details about the board and the QorIQ Layerscape SoC, see the following
Layerscape platforms are officially supported by NXP under the Layerscape
Debian Linux SDK (LDLSDK). This uses components from Linux Factory (project
common with i.MX), but has a slower release cadence than LF. The currently used
tag is lf-6.18.20-2.0.0, which is in line with the latest LF tag. Generally, in
tag is lf-6.12.34-2.1.0, which is in line with the latest LF tag. Generally, in
Buildroot, the latest Linux Factory release tag is always used, which may be
considered pre-release software, as it may contain features which are not yet
documented, and it generally undergoes less testing.
@@ -21,13 +21,13 @@ For the software Layerscape Debian Linux SDK User Guide, see:
- https://www.nxp.com/docs/en/user-guide/UG10143.pdf
The components from NXP are:
- rcw, lf-6.18.20-2.0.0
- atf (fork), lf-6.18.20-2.0.0
- uboot (fork), lf-6.18.20-2.0.0
- qoriq-fm-ucode (blob), lf-6.18.20-2.0.0
- linux (fork), lf-6.18.20-2.0.0
- fmlib, lf-6.18.20-2.0.0
- fmc, lf-6.18.20-2.0.0
- rcw, lf-6.12.34-2.1.0
- atf (fork), lf-6.12.34-2.1.0
- uboot (fork), lf-6.12.34-2.1.0
- qoriq-fm-ucode (blob), lf-6.12.34-2.1.0
- linux (fork), lf-6.12.34-2.1.0
- fmlib, lf-6.12.34-2.1.0
- fmc, lf-6.12.34-2.1.0
Build
=====

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 658af40a90fd8e2460d364775a0c37e0507201e49de7f69c8a22d61e179f81e1 atf-lf-6.18.20-2.0.0.tar.gz
sha256 2d3f9c52e16766c290bdc0bc130d634e4c326a5b236dfb2f2ca3f0fa457e82d4 atf-lf-6.12.34-2.1.0.tar.gz

View File

@@ -1,2 +1,2 @@
# Locally computed
sha256 206f997d41bb958099bf7a89a02a6889942b118984f81f9a45bec9907f60708f linux-lf-6.18.20-2.0.0.tar.gz
sha256 27a1987ca0a5802d3ebb296b8134ec66d813ad86cf2a60779b45092735bbb23b linux-lf-6.12.34-2.1.0.tar.gz

View File

@@ -1,2 +1,2 @@
# Locally computed
sha256 04aed627132db7b656117c7a35fb29d314172319fa3a297ea6748eebac2b5ce3 u-boot-lf-6.18.20-2.0.0.tar.gz
sha256 2f25cde388b2f83ff7a8e3afe25aafb1db48dafb0fa3bf1e4f9fef603f3b4785 u-boot-lf-6.12.34-2.1.0.tar.gz

View File

@@ -12,7 +12,7 @@ For more details about the board and the QorIQ Layerscape SoC, see the following
Layerscape platforms are officially supported by NXP under the Layerscape
Debian Linux SDK (LDLSDK). This uses components from Linux Factory (project
common with i.MX), but has a slower release cadence than LF. The currently used
tag is lf-6.18.20-2.0.0, which is in line with the latest LF tag. Generally, in
tag is lf-6.12.34-2.1.0, which is in line with the latest LF tag. Generally, in
Buildroot, the latest Linux Factory release tag is always used, which may be
considered pre-release software, as it may contain features which are not yet
documented, and it generally undergoes less testing.
@@ -22,13 +22,13 @@ For the software Layerscape Debian Linux SDK User Guide, see:
- https://www.nxp.com/docs/en/user-guide/UG10143.pdf
The components from NXP are:
- rcw, lf-6.18.20-2.0.0
- atf (fork), lf-6.18.20-2.0.0
- uboot (fork), lf-6.18.20-2.0.0
- qoriq-fm-ucode (blob), lf-6.18.20-2.0.0
- linux (fork), lf-6.18.20-2.0.0
- fmlib, lf-6.18.20-2.0.0
- fmc, lf-6.18.20-2.0.0
- rcw, lf-6.12.34-2.1.0
- atf (fork), lf-6.12.34-2.1.0
- uboot (fork), lf-6.12.34-2.1.0
- qoriq-fm-ucode (blob), lf-6.12.34-2.1.0
- linux (fork), lf-6.12.34-2.1.0
- fmlib, lf-6.12.34-2.1.0
- fmc, lf-6.12.34-2.1.0
Build
=====

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 658af40a90fd8e2460d364775a0c37e0507201e49de7f69c8a22d61e179f81e1 atf-lf-6.18.20-2.0.0.tar.gz
sha256 2d3f9c52e16766c290bdc0bc130d634e4c326a5b236dfb2f2ca3f0fa457e82d4 atf-lf-6.12.34-2.1.0.tar.gz

View File

@@ -1,2 +1,2 @@
# Locally computed
sha256 206f997d41bb958099bf7a89a02a6889942b118984f81f9a45bec9907f60708f linux-lf-6.18.20-2.0.0.tar.gz
sha256 27a1987ca0a5802d3ebb296b8134ec66d813ad86cf2a60779b45092735bbb23b linux-lf-6.12.34-2.1.0.tar.gz

View File

@@ -1,2 +1,2 @@
# Locally computed
sha256 04aed627132db7b656117c7a35fb29d314172319fa3a297ea6748eebac2b5ce3 u-boot-lf-6.18.20-2.0.0.tar.gz
sha256 2f25cde388b2f83ff7a8e3afe25aafb1db48dafb0fa3bf1e4f9fef603f3b4785 u-boot-lf-6.12.34-2.1.0.tar.gz

View File

@@ -11,7 +11,7 @@ for more details about the board and the QorIQ Layerscape SoC, see the following
Layerscape platforms are officially supported by NXP under the Layerscape
Debian Linux SDK (LDLSDK). This uses components from Linux Factory (project
common with i.MX), but has a slower release cadence than LF. The currently used
tag is lf-6.18.20-2.0.0, which is in line with the latest LF tag. Generally, in
tag is lf-6.12.34-2.1.0, which is in line with the latest LF tag. Generally, in
Buildroot, the latest Linux Factory release tag is always used, which may be
considered pre-release software, as it may contain features which are not yet
documented, and it generally undergoes less testing.
@@ -21,13 +21,13 @@ For the software Layerscape Debian Linux SDK User Guide, see:
- https://www.nxp.com/docs/en/user-guide/UG10143.pdf
The components from NXP are:
- rcw, lf-6.18.20-2.0.0
- atf (fork), lf-6.18.20-2.0.0
- uboot (fork), lf-6.18.20-2.0.0
- qoriq-fm-ucode (blob), lf-6.18.20-2.0.0
- linux (fork), lf-6.18.20-2.0.0
- fmlib, lf-6.18.20-2.0.0
- fmc, lf-6.18.20-2.0.0
- rcw, lf-6.12.34-2.1.0
- atf (fork), lf-6.12.34-2.1.0
- uboot (fork), lf-6.12.34-2.1.0
- qoriq-fm-ucode (blob), lf-6.12.34-2.1.0
- linux (fork), lf-6.12.34-2.1.0
- fmlib, lf-6.12.34-2.1.0
- fmc, lf-6.12.34-2.1.0
Build
=====

View File

@@ -0,0 +1 @@
../linux/linux.hash

View File

@@ -1,2 +1,2 @@
# From https://www.kernel.org/pub/linux/kernel/v6.x/sha256sums.asc
sha256 f4855f382c1b735c84072bdef36db5bcd5dc7b0c37e42f5104317149a0a486ef linux-6.18.18.tar.xz
# Locally calculated
sha256 93218296934915636fe6ba08e125948424cc270fd8948502c0ab91087a9fccd8 linux-6.6.44.tar.xz

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 b60d5865cefdbc75da8da4156c56c458e00de75a49b80c1a2e58a96e30ad0d54 u-boot-2026.01.tar.bz2
sha256 f591da9ab90ef3d6b3d173766d0ddff90c4ed7330680897486117df390d83c8f u-boot-2024.07.tar.bz2

View File

@@ -1,2 +0,0 @@
# From https://www.kernel.org/pub/linux/kernel/v6.x/sha256sums.asc
sha256 f4855f382c1b735c84072bdef36db5bcd5dc7b0c37e42f5104317149a0a486ef linux-6.18.18.tar.xz

View File

@@ -1,2 +0,0 @@
# Locally calculated
sha256 b60d5865cefdbc75da8da4156c56c458e00de75a49b80c1a2e58a96e30ad0d54 u-boot-2026.01.tar.bz2

View File

@@ -27,6 +27,7 @@ image sdcard.img {
partition rootfs {
partition-type = 0x83
image = "rootfs.ext2"
size = 128M
offset = 0
}
}

Some files were not shown because too many files have changed in this diff Show More