Compare commits

..

422 Commits

Author SHA1 Message Date
Arnout Vandecappelle
679b9ead76 Makefile: Update for 2026.02.3
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2026-06-16 23:00:17 +02:00
Arnout Vandecappelle
dad077f48d CHANGES: Update for 2026.02.3
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2026-06-16 22:50:17 +02:00
Giulio Benetti
702b01dc96 package/esp-hosted: don't treat warnings as errors
This driver fails to build because warnings are treated as errors but
this is too strict, breaking the build.

This used to be hidden by commit 6b56e0b4f0 ("linux: disable -Werror"),
which was reverted in commit a966f5cde5 ("Revert "linux: disable -Werror""),
so fix it by explicitly passing -Wno-error.

Fixes:
https://autobuild.buildroot.org/results/df3763e74de4071331a41140fb5528523af9e374/

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
[Peter: add note about when issue was (re-)introduced]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit daf4962937)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-12 13:34:51 +02:00
Romain Naour
470e20cadd configs/arcturus_ucp1020: specify Linux license file
The used Linux kernel (4.4.144) does not contain the default license
files as those were only added in 4.16 with commit e00a844aca
("LICENSES: Add Linux syscall note exception"), so specify the correct
license file to fix:

make legal-info
..
cp: cannot stat '/path/to/output/build/linux-headers-custom/LICENSES/preferred/GPL-2.0': No such file or directory

And add the sha256sum to the .hash file.
Enable BR2_DOWNLOAD_FORCE_CHECK_HASHES.

Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/14728913808 (arcturus_ucp1020_defconfig)

Signed-off-by: Romain Naour <romain.naour@smile.fr>
Cc: Michael Durrant <mdurrant@ArcturusNetworks.com>
[Julien: remove .checkpackageignore entry to fix check-package error]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit bbb1e2c8df)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-11 11:56:23 +02:00
Romain Naour
364a271d94 configs/at91sam9x5ek*: remove at91bootstrap3 license
When using a specific git repo and version for at91bootstrap3,
BR2_TARGET_AT91BOOTSTRAP3_LICENSE_FILES defaults to "LICENSES/MIT.txt".
However the git version we use (namely v3.10.3) does not provide this
file. Actually, it does not provide a license file at all. This causes
‘make legal-info’ to fail with:

    >>> at91bootstrap3 v3.10.3 Collecting legal info
    sha256sum: /builds/buildroot.org/buildroot/output/build/at91bootstrap3-v3.10.3/LICENSES/MIT.txt: No such file or directory
    ERROR: while checking hashes from boot/at91bootstrap3/at91bootstrap3.hash
    ERROR: LICENSES/MIT.txt has wrong sha256 hash:
    ERROR: expected: 5a3809b1c2ba13b7242572322951311c584419f1f8516f665d6c06f0668d78de
    ERROR: got     :
    ERROR: Incomplete download, or man-in-the-middle (MITM) attack
    make[1]: *** [boot/at91bootstrap3/at91bootstrap3.mk:112: at91bootstrap3-legal-info] Error 1

Let's be explicit that there is no license file to check.

Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/14728913821 (at91sam9x5ek_mmc_dev_defconfig)
https://gitlab.com/buildroot.org/buildroot/-/jobs/14728913820 (at91sam9x5ek_mmc_defconfig)
https://gitlab.com/buildroot.org/buildroot/-/jobs/14728913819 (at91sam9x5ek_dev_defconfig)
https://gitlab.com/buildroot.org/buildroot/-/jobs/14728913818 (at91sam9x5ek_defconfig)

Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 1339bba787)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-11 11:56:08 +02:00
Peter Korsgaard
be1ee6a0bc package/libusb: security bump to version 1.0.30
Fixes the following security issues:

CVE-2026-23679: libusb before version 1.0.30 contains a NULL pointer
dereference vulnerability that allows attackers to crash applications by
supplying a malformed USB configuration descriptor where an interface claims
bNumEndpoints greater than zero but is followed by a class-specific
descriptor whose bLength exceeds the remaining buffer size, causing
parse_interface() to return early without allocating the endpoint array.
Attackers can exploit this flaw through libusb_get_active_config_descriptor
or libusb_get_config_descriptor by providing crafted descriptors via
virtualized USB passthrough, file-based descriptor parsing, or network
sources, causing any application iterating over endpoints to dereference a
NULL endpoint pointer and crash.

https://nvd.nist.gov/vuln/detail/CVE-2026-23679

CVE-2026-47104: libusb before version 1.0.30 contains a one-byte
out-of-bounds read vulnerability in parse_iad_array() in descriptor.c that
allows attackers to trigger a denial of service by supplying a malformed USB
descriptor whose bLength equals size minus one, causing the bounds check to
use the original buffer size instead of the remaining size.  Attackers in
virtualized environments with USB passthrough can supply crafted descriptors
through libusb_get_active_interface_association_descriptors or
libusb_get_interface_association_descriptors to read one byte past the end
of the malloc allocation, resulting in a denial of service.

https://nvd.nist.gov/vuln/detail/CVE-2026-47104

For more details, see the announcement:
https://sourceforge.net/p/libusb/mailman/message/59335553/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 907ebab6d9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-11 11:51:30 +02:00
Bernd Kuhls
1d11999065 package/libde265: security bump version to 1.1.1
https://github.com/strukturag/libde265/releases/tag/v1.1.1

Fixes the following security problems:

CVE TBD (GHSA-ccfw-29x7-rrx3)
- Pixel accessor signed integer overflow causes heap OOB read/write

CVE TBD (GHSA-j2qq-x2xq-g9wr)
- SAO sequential filter heap buffer overflow via signed integer overflow

This version bump includes upstream commit
9ded37bda4
which uses constexpr() and causes a build error caught by the Gitlab
pipelines with the gcc-6-based bootlin-aarch64-glibc-old defconfig:

/builds/bkuhls/buildroot/br-test-pkg/bootlin-aarch64-glibc-old/build/libde265-1.1.1/libde265/deblock.cc:594:14:
 error: expected ‘(’ before ‘constexpr’
           if constexpr (sizeof(pixel_t)==1) {

Therefore we need to raise the minimum gcc version according to
https://gcc.gnu.org/projects/cxx-status.html#cxx17 to gcc 7.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 35b57a0787)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-11 11:49:50 +02:00
Bernd Kuhls
59b48d516d package/python3: add upstream security patch for CVE-2026-8328
https://mail.python.org/archives/list/security-announce@python.org/thread/ITF2BAPBQEPYK3LDMPRSY435JGNHYNDP/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d4be78ccb5)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-11 11:48:11 +02:00
Bernd Kuhls
72acbde49f package/python3: add upstream security patch for CVE-2026-7774
https://mail.python.org/archives/list/security-announce@python.org/thread/4FU62L2M6RMMHT2QPGQNPEHHUND7CEX5/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 67ec0e9c20)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-11 11:48:02 +02:00
Bernd Kuhls
cb6bcec96a package/php: security bump version to 8.5.7
https://www.php.net/ChangeLog-8.php#8.5.7
https://news-web.php.net/php.announce/493
https://github.com/php/php-src/blob/php-8.5.7/NEWS

Fixes CVE-2026-44927 & CVE-2026-44928.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 08f8c44d15)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-11 11:47:29 +02:00
Bernd Kuhls
42581bd3cf package/python3: add upstream security patch for CVE-2026-3276
https://seclists.org/oss-sec/2026/q2/801

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 9cba1cfaaf)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-11 11:45:40 +02:00
Peter Korsgaard
eb324a07fb package/docker-cli: bump version to 28.3.3
For consistency with docker-engine. Release notes:

https://github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.3.3

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 50bc0b5fda)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-11 11:45:15 +02:00
Peter Korsgaard
e36265aafb package/docker-engine: security bump to version 28.3.3
Fixes the following security issue:

- CVE-2025-54388: Firewalld reload makes published container ports
  accessible from remote hosts

  https://github.com/moby/moby/security/advisories/GHSA-x4rx-4gw3-53p4

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 831335ac71)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-11 11:44:32 +02:00
Bernd Kuhls
44228e3f97 package/x11r7/xwayland: security bump version to 24.1.12
Advisory (no CVEs yet):
https://lists.x.org/archives/xorg-announce/2026-June/003702.html

Release notes:
https://lists.x.org/archives/xorg-announce/2026-June/003704.html

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 990c39b588)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-11 11:42:26 +02:00
Thomas Perale
267ef20bfb package/hplip: update CPE
The 'hp:linux_imaging_and_printing_project' hasn't received any new CVE
assignment since 2013, while 'hp:linux_imaging_and_printing' received 4
[1][2][3][4].

See the package vulnerability history at [5].

[1] https://nvd.nist.gov/vuln/detail/CVE-2015-0839
[2] https://nvd.nist.gov/vuln/detail/CVE-2020-6923
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-8631
[4] https://nvd.nist.gov/vuln/detail/CVE-2026-8632
[5] https://security-tracker.debian.org/tracker/source-package/hplip

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 534ae54df9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-11 11:41:17 +02:00
Thomas Perale
69b4c79831 package/sane-backends: update CPE
The CPE 'sane-backends_project:sane-backends' only has a single CVE
assigned in 2017 while 'sane-project:sane_backends' has 9 since 2017
[1].

See the package CVE history at [2].

[1] https://nvd.nist.gov/vuln/detail/CVE-2023-46047
[2] https://security-tracker.debian.org/tracker/source-package/sane-backends

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 41e76b356c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-11 11:41:10 +02:00
Thomas Perale
15c4752473 package/python-ecdsa: update CPE
The CPE 'python-ecdsa_project:python-ecdsa' hasn't received new CVE
since 2019 while 'tlsfuzzer:ecdsa' received two [1][2].

See the package CVE history at [3].

[1] https://nvd.nist.gov/vuln/detail/CVE-2026-33936
[2] https://nvd.nist.gov/vuln/detail/CVE-2024-23342
[3] https://security-tracker.debian.org/tracker/source-package/python-ecdsa

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit f3687ebafa)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-11 11:41:03 +02:00
Thomas Perale
80e6c6271a package/gstreamer1/gst1-plugins-good: add CPE
The CPE 'freedesktop:gst-plugins-good' is correct for this package [1].

Also used in conjunction of 'gstreamer:gstreamer', see the package
vulnerability history [2].

[1] https://nvd.nist.gov/vuln/detail/CVE-2026-46470
[2] https://security-tracker.debian.org/tracker/source-package/gst-plugins-good1.0

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 0c9ccb9327)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-11 11:40:51 +02:00
Thomas Perale
bd37cbe903 package/faad2: update CPE
The CPE audiocoding:freeware_advanced_audio_decoder_2 hasn't received
any new CVEs since 2018 while faad2_project:faad2 received 9 new cves
[1].

See the full history in [2].

[1] https://nvd.nist.gov/vuln/detail/CVE-2023-38857
[2] https://security-tracker.debian.org/tracker/source-package/faad2

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
[Peter: set FAAD2_CPE_ID_VALID = YES for check-package]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit ab03ba7396)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-11 11:40:43 +02:00
Thomas Perale
bb11e239f0 package/lrzip: update CPE
The CPE long_range_zip_project:long_range_zip hasn't been used since
2023. While ckolivas:lrzip got 3 CVEs that affect the current Buildroot
version [1][2][3].

[1] https://nvd.nist.gov/vuln/detail/CVE-2025-9396
[2] https://nvd.nist.gov/vuln/detail/CVE-2025-15570
[2] https://nvd.nist.gov/vuln/detail/CVE-2025-15571

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 2dce5a7844)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-11 11:40:08 +02:00
Bernd Kuhls
1eb0e3f0d6 package/freeipmi: security bump version to 1.6.18
https://lists.gnu.org/archive/html/freeipmi-announce/2026-06/msg00000.html
https://savannah.gnu.org/news/?id=10898

Fixes CVE-2026-50031: https://seclists.org/oss-sec/2026/q2/794

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit dd72456fc6)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-11 11:36:47 +02:00
Peter Korsgaard
da1c00a6f1 package/runc: security bump to version 1.3.5
Fixes the following security issues (1.3.3):

- CVE-2025-31133: container escape via "masked path" abuse due to mount race
  conditions
  https://github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2

- CVE-2025-52565: container escape with malicious config due to /dev/console
  mount and related races
  https://github.com/opencontainers/runc/security/advisories/GHSA-qw9x-cqr3-wc7r

- CVE-2025-52881: container escape and denial of service due to arbitrary
  write gadgets and procfs write redirects
  https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm

In addition, 1.3.4 and 1.3.5 fixes a number of regressions.  For details,
see the release notes:

https://github.com/opencontainers/runc/releases/tag/v1.3.1
https://github.com/opencontainers/runc/releases/tag/v1.3.2
https://github.com/opencontainers/runc/releases/tag/v1.3.3
https://github.com/opencontainers/runc/releases/tag/v1.3.4
https://github.com/opencontainers/runc/releases/tag/v1.3.5

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Reviewed-by: Christian Stewart <christian@aperture.us>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit e013e2df84)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-11 10:35:14 +02:00
Bernd Kuhls
4855845127 package/privoxy: security bump version to 4.2.0
Fixes the following security issues:

- Parse the chunk-size with a dedicated function and reject "unreasonably"
  large values to prevent silent truncation by sscanf(), integer overflows
  and misinterpretation of the content later on. Heap buffer overflows on
  platforms with 32-bit pointers were alleged as well.
  Commit 5b3bb22b77. OVE-20260515-0002. Reported by @TristanInSec.

- ssl_send_certificate_error(): Store the generated message on the heap
  instead of the stack to prevent an alleged segmentation fault if there
  are enough certificates in the chain to exceed the stack size.
  While at it, replace another variable-length array that was probably
  unproblematic with a heap-based buffer as well.
  Commit 4963aa4f08. OVE-20260515-0001. Reported by @TristanInSec.

https://www.privoxy.org/gitweb/?p=privoxy.git;a=blob;f=ChangeLog;h=d62aa6bf0b2cb26100e4ba8e528638259502711d;hb=0c5225b6844dd1a838b80d09d715a6c4ccbda2c6

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Peter: add vulnerability info]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 283a7a15b2)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-11 10:34:57 +02:00
Thomas Perale
fe9dc2ed1d package/capnproto: add upstream security patch for CVE-2026-322{39,40}
- CVE-2026-32239:
    Cap'n Proto is a data interchange format and capability-based RPC
    system. Prior to 1.4.0, a negative Content-Length value was converted
    to unsigned, treating it as an impossibly large length instead. In
    theory, this bug could enable HTTP request/response smuggling. This
    vulnerability is fixed in 1.4.0.

For more information, see:
 - https://github.com/capnproto/capnproto/security/advisories/GHSA-qjx3-pp3m-9jpm
 - https://www.cve.org/CVERecord?id=CVE-2026-32239

- CVE-2026-32240:
    Cap'n Proto is a data interchange format and capability-based RPC
    system. Prior to 1.4.0, when using Transfer-Encoding: chunked, if a
    chunk's size parsed to a value of 2^64 or larger, it would be
    truncated to a 64-bit integer. In theory, this bug could enable HTTP
    request/response smuggling. This vulnerability is fixed in 1.4.0.

For more information, see:
 - https://github.com/capnproto/capnproto/security/advisories/GHSA-vpcq-mx5v-32wm
 - https://www.cve.org/CVERecord?id=CVE-2026-32240

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 7f0749ce73)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-11 10:33:29 +02:00
Thomas Perale
ceffff2e53 package/unzip: patch CVE-2021-4217
The patch is provided thanks to the Ubuntu community.

- CVE-2021-4217:
    A flaw was found in unzip. The vulnerability occurs due to improper
    handling of Unicode strings, which can lead to a null pointer
    dereference. This flaw allows an attacker to input a specially crafted
    zip file, leading to a crash or code execution.

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2021-4217
 - https://launchpadlibrarian.net/580782282/0001-Fix-null-pointer-dereference-and-use-of-uninitialized-data.patch
 - https://bugs.launchpad.net/ubuntu/+source/unzip/+bug/1957077

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
[Peter: correct _IGNORE_CVES entry]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 4e73a15a7b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-11 10:33:15 +02:00
Thomas Perale
b19ea523d6 package/libssh2: add upstream security patch for CVE-2026-7598
This commit fixes the following vulnerability:

- CVE-2026-7598:
    A security vulnerability has been detected in libssh2 up to 1.11.1.
    The impacted element is the function userauth_password of the file
    src/userauth.c. Such manipulation of the argument
    username_len/password_len leads to integer overflow. The attack may be
    launched remotely. The name of the patch is
    256d04b60d80bf1190e96b0ad1e91b2174d744b1. A patch should be applied to
    remediate this issue.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2026-7598
  - 256d04b60d

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 061d6b121b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-11 10:31:27 +02:00
Bernd Kuhls
676d275250 package/x11r7/xserver_xorg-server: security bump version to 21.1.23
Advisory (no CVEs yet):
https://lists.x.org/archives/xorg-announce/2026-June/003702.html

Release notes:
https://lists.x.org/archives/xorg-announce/2026-June/003703.html

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 20489205ea)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-11 10:31:10 +02:00
Arnout Vandecappelle
b8cc9b4b35 support/scripts/generate-gitlab-ci-yml: use large runners for defconfigs
defconfigs are very unlikely to successfully build on a small runner
because they build a kernel (and often a toolchain). They're also likely
to benefit a lot from the additional parallelism on larger runners.

For now, always build them on large runners. There may be some for which
even the large runners don't have sufficient disk space or memory, but
we'll solve that when it happens.

Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit f93dbfca13)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-11 10:30:44 +02:00
Romain Naour
f4c69e4ff0 support/testing: TestPppd: force the baudrate for pppd
Since the ARM AArch64 toolchain toolchain bump [1], the TestPppd fail
at runtime since ttyppp0 and ttyppp1 interfaces were not created
properly:

    pppd[87]: pppd 2.5.2 started by root, uid 0
    pppd[87]: Baud rate for /dev/ttyppp1 is 0; need explicit baud rate

The new toolchain uses glibc 2.42 that include a rework in termios
"implement arbitrary and split speeds in termios" to support BOTHER
[2]. This rework seems to conflict with pppd workaround [3] introduced
when BOTHER was not supported in Glibc.

Fix this by setting the baudrate on pppd command line (we already set
this baudrate on socat command line).

Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/14607335920 (TestPppd)

[1] 8d413d6179
[2] https://sourceware.org/git/?p=glibc.git;a=commit;h=5cf101a85aae0d703cdd8ed7b25fe288e41fdacb
[3] d65f6713c8

Fix-suggested-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 50d772b66b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-11 10:30:42 +02:00
Romain Naour
c4a95526c0 support/testing: use larger runner to reduce the CI minute consumed per pipeline
Based on the first pipeline result [1], use larger runner for the
following tests:

  tests.fs.test_oci.TestOci.test_run (01:08:15)
  saas-linux-small-amd64 -> saas-linux-xlarge-amd64

  tests.package.test_dpdk.TestDPDK.test_run (01:08:36)
  saas-linux-small-amd64 -> saas-linux-xlarge-amd64

  tests.package.test_z3.TestZ3.test_run (01:11:41)
  saas-linux-small-amd64 -> saas-linux-xlarge-amd64

  tests.package.test_octave.TestOctave.test_run (01:21:57)
  saas-linux-small-amd64 -> saas-linux-xlarge-amd64

  tests.package.test_podman.TestPodmanSlirpNftables.test_run (01:21:15)
  saas-linux-small-amd64 -> saas-linux-xlarge-amd64

  tests.package.test_podman.TestPodmanSlirpIptables.test_run (01:21:25)
  saas-linux-small-amd64 -> saas-linux-xlarge-amd64

  tests.package.test_mariadb.TestMariaDB.test_run (01:26:15)
  saas-linux-small-amd64 -> saas-linux-xlarge-amd64

  tests.package.test_podman.TestPodmanIptables.test_run (01:28:51)
  saas-linux-small-amd64 -> saas-linux-xlarge-amd64

  tests.package.test_podman.TestPodmanTini.test_run (01:29:08)
  saas-linux-small-amd64 -> saas-linux-xlarge-amd64

  tests.package.test_podman.TestPodmanNftables.test_run (01:41:26)
  saas-linux-small-amd64 -> saas-linux-xlarge-amd64

  tests.package.test_weston.TestWeston.test_run (01:26:17)
  saas-linux-large-amd64 -> saas-linux-2xlarge-amd64

  tests.package.test_python_pyqt5.TestPythonPyQt5.test_run (01:41:33)
  saas-linux-large-amd64 -> saas-linux-2xlarge-amd64

  tests.package.test_nodejs.TestNodeJSModuleHostBin.test_run (01:21:06)
  saas-linux-large-amd64 -> saas-linux-2xlarge-amd64

  tests.package.test_flutter.TestFlutter.test_run (01:03:05)
  saas-linux-xlarge-amd64 -> saas-linux-2xlarge-amd64

For tests long that already use 2xlarge runner tag, we may have to run
them on Gitlab runners owned by the Buildroot project.

[1] https://gitlab.com/buildroot.org/buildroot/-/pipelines/2562421098

Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 13a0129b0a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-11 10:30:40 +02:00
Romain Naour
40f10a484c support/testing: generate runtime test jobs with runner tags
We have our own GitLab-CI runner, but with only one we can't run many
jobs in parallel so it takes a very long time before all the tests have
completed. In addition, if that runner goes down, we have nothing at
all.

GitLab offers the following machine types for hosted runners on Linux
x86-64 [1]. The default is the "small" runner. Using a larger runner
increases the "Cost factor" [2].

For opensource projects, the Cost factor is reduced to 0.5 (1 minute per
2 minutes of job time) whatever the runner type.

Runner Tag                                             vCPUs   Memory  Storage  Cost factor (OSS)
saas-linux-small-amd64 (default)                           2     8 GB    30 GB     1 (0.5)
saas-linux-medium-amd64                                    4    16 GB    50 GB     2 (0.5)
saas-linux-large-amd64 (Premium and Ultimate only)         8    32 GB   100 GB     3 (0.5)
saas-linux-xlarge-amd64 (Premium and Ultimate only)       16    64 GB   200 GB     6 (0.5)
saas-linux-2xlarge-amd64 (Premium and Ultimate only)      32   128 GB   200 GB    12 (0.5)

Compute minutes consumed by a job is calculated by:

  Job duration / 60 * Cost factor

(Job duration: The time, in seconds, that a job took to run, not
including time spent in the created or pending statuses.)

Thanks to the GitLab OSS program [3], Buildroot benefits from a free
Ultimate subscription and can use GitLab shared runners tagged with
saas-linux-{large, xlarge, 2xlarge}-amd64. In addition, we receive
50,000 free runner minutes per month.

In order to use one of those tags in Buildroot GitLab-CI jobs, we have
to classify all tests by resource requirement, to make sure the job
doesn't fail because it times out or has insufficient memory or disk
space. While we usually shouldn't use the largest runner for
everything, we can use larger runner without cost penalty thanks to
the cost factor reduced to 0.5 for opensource projects. This will
reduce the CI minutes consumed by a CPU intensive job.

First we introduce some new templates used to add the corresponding
runner tag to a runtime test job (reusing the GitLab terminology).

    .runner-{small,medium,large,xlarge,2xlarge}

Most of our tests are fast (checkpackage, test_external_bootlin...), so
saas-linux-small-amd64 runner tag is enough. Default to this tag if
nothing else is specified.

Add a comment next to the test class to provide the runner tag.
This runner tag is retrieved when generating the
generated-gitlab-ci.yml file used to create the child pipeline where
the runtime test jobs are executed.

We use the list of runtime tests returned by node2:

  "tests.boot.test_edk2.TestEdk2.test_run"

We convert each element of this list to get the path to the test source
file and the name of the test:

  "support/testing/tests/boot/test_edk2.py"

  TestEdk2

With that, we can grep into the test source file to retrieve the runner
tag placed one line above the test class:

  # GitLab-runner: large
  class TestEdk2(infra.basetest.BRTest):

Once the runner tag is retrieved, it's used to use the corresponding
runner template to the runtime test job:

  tests.boot.test_edk2.TestEdk2.test_run: { extends: [ .runtime_test_base, .runner-large ]}

GitLab runners hosted by the Buildroot project should be able to run
any jobs, so they should be tagged with Gitlab runner tags
(saas-linux-{small,medium,large,xlarge,2xlarge}-amd64).
A specific runner tag "buildroot-runner" can be used to allow running
a job only on such runners.

If a test can't be executed by any shared GitLab-CI runners, we have
to use a runner owned by the Buildroot project. In this case we have
to use a specific template ".runner-buildroot-runner-only" in order to
add the specific runner tag "buildroot-runner" to the job running the
test. There is no such runtime test at the moment.

The proposed classification is based on a previous pipeline analysis
[5]:

  - Tests lasting more than 3 hours will use 2xlarge runners.
  - Tests lasting more than 2 hours will use xlarge runners.
  - Tests lasting more than 1 hours will use large runners.
  - Tests building a kernel or a toolchain will use medium runners.
  - All other tests will use small runners when possible.

CI minute cost estimate:

tests.package.test_clang.TestClangCompilerRT.test_run lasts 4h25 on the
Buildroot runner. If we this duration for 2xlarge runners, the CI
minute consumed would be:

  (15900 / 60) * 0.5 = 133

With 6 jobs using a 2xlarge runners we used ~795 CI minutes.

tests.package.test_kmscube.TestKmsCube.test_run list 2h04 on the
Buildroot runner. If we	this duration for xlarge runners, the CI
minute consumed would be:

  (7440 / 60) * 0.5 = 62

With 4 jobs using a xlarge runners we used ~248 CI minutes.

tests.package.test_weston.TestWeston.test_run last 1h15 on th
Buildroot runner. If we this duration for large runners, the CI
minute consumed would be:

  (4500 / 60) * 0.5 = 37.5

With 28 jobs using a large runners we used ~1050 CI minutes.

tests.package.test_gstreamer1.TestGstreamer1.test_run last 46min on the
Buildroot runner. If we this duration for large runners, the CI
minute consumed would be:

  (2760 / 60) * 0.5 = 23

With 31 jobs using a medium runners we used ~713 CI minutes.

tests.package.test_python.TestPython3Py.test_run last 13min on the
Buildroot runner. If we this duration for large runners, the CI
minute consumed would be:

  (780 / 60) * 0.5 = 6.5

With 691 jobs using a medium runners we used ~4491 CI minutes.

In total, one pipeline for the runtime tests cost ~7297 CI minutes.
After a first try [6], we are actually using 8000 CI minutes per
pipeline.

We run such pipeline once a week (on Monday), one for each Buildroot
releases every 3 month, one for each stable and LTS release per month,
and one for each release candidate (3).

Worst case (release month):
(4 weeks + 1 release + 1 stable + 1 LTS + 3 release candidate) * 8000 CI
minutes: 80000 CI minutes / 50000.

So we would spend the minutes very quickly in the worst case scenario.
We have to keep one pipeline under 5000 CI minutes.

[1] https://docs.gitlab.com/ci/runners/hosted_runners/linux/#machine-types-available-for-linux---x86-64
[2] https://docs.gitlab.com/ci/pipelines/compute_minutes/#cost-factors
    https://docs.gitlab.com/ci/pipelines/compute_minutes/#compute-usage-calculation
    https://docs.gitlab.com/ci/pipelines/compute_minutes/#cost-factors-of-hosted-runners-for-gitlabcom
[3] https://gitlab.com/buildroot.org/gitlab-oss
[4] https://docs.gitlab.com/ci/runners/hosted_runners/#gitlabcom-hosted-runner-workflow
[5] https://gitlab.com/buildroot.org/buildroot/-/pipelines/2416603721
[6] https://gitlab.com/buildroot.org/buildroot/-/pipelines/2562421098

Signed-off-by: Romain Naour <romain.naour@smile.fr>
[Arnout:
 - simplify parsing of test_file and test_name;
 - match the entire test_name instead of substring;
 - assume "small" by default;
 - remove the "small" tags;
 - use "gitlab-runner" instead of "Gitlab-runner".
]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>

Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit c9df1b64b2)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-11 10:26:39 +02:00
Arnout Vandecappelle
10a19baca4 support/scripts/generate-gitlab-ci-yml: support scheduled pipelines
Currently the weekly pipelines are triggered from a cron job on the
Buildroot server, so generate-gitlab-ci-yml filters on the "trigger"
source. However, we'd like to schedule it on gitlab itself, which makes
managing it easier.

We could filter on "schedule" in addition to "trigger", but there's not
really a reason to. We can simply rely on the BR_SCHEDULE_JOBS variable
- if it is set, we use its information.

Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit c0922004d8)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-11 10:20:02 +02:00
Bernd Kuhls
3d7636a805 package/tor: security bump version to 0.4.9.9
https://gitlab.torproject.org/tpo/core/tor/-/blob/tor-0.4.9.9/ReleaseNotes

Fixes
TROVE-2026-013, TROVE-2026-014, TROVE-2026-015, TROVE-2026-016,
TROVE-2026-017, TROVE-2026-018, TROVE-2026-019, TROVE-2026-020,
TROVE-2026-021 & TROVE-2026-022.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f9a9f240c1)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-11 10:17:21 +02:00
Bernd Kuhls
ea14a38855 package/sane-airscan: needs BR2_TOOLCHAIN_HAS_SYNC_4
Fixes a build error

output/per-package/sane-airscan/host/opt/ext-toolchain/bin/../lib/gcc/sparc-buildroot-linux-uclibc/14.3.0/../../../../sparc-buildroot-linux-uclibc/bin/ld:
 libsane-airscan.so.1.p/airscan-http.c.o: in function `http_data_ref':
airscan-http.c:(.text+0x1c88): undefined reference to `__sync_fetch_and_add_4'
output/per-package/sane-airscan/host/opt/ext-toolchain/bin/../lib/gcc/sparc-buildroot-linux-uclibc/14.3.0/../../../../sparc-buildroot-linux-uclibc/bin/ld:
 libsane-airscan.so.1.p/airscan-http.c.o: in function `http_data_unref':
airscan-http.c:(.text+0x1cd0): undefined reference to `__sync_sub_and_fetch_4'
output/per-package/sane-airscan/host/opt/ext-toolchain/bin/../lib/gcc/sparc-buildroot-linux-uclibc/14.3.0/../../../../sparc-buildroot-linux-uclibc/bin/ld:
 libsane-airscan.so.1.p/airscan-trace.c.o: in function `trace_ref':
airscan-trace.c:(.text+0x32c): undefined reference to `__sync_fetch_and_add_4'
output/per-package/sane-airscan/host/opt/ext-toolchain/bin/../lib/gcc/sparc-buildroot-linux-uclibc/14.3.0/../../../../sparc-buildroot-linux-uclibc/bin/ld:
 libsane-airscan.so.1.p/airscan-trace.c.o: in function `trace_unref':
airscan-trace.c:(.text+0x358): undefined reference to `__sync_sub_and_fetch_4'

with this defconfig

BR2_sparc=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_SPARCV8_UCLIBC_STABLE=y
BR2_PACKAGE_SANE_AIRSCAN=y

detected by the Gitlab pipelines while testing to bump of sane-backends
to 1.4.0 in this series.

The build error is caused by an upstream commit added in 2020 to version
0.99.14:
fccd8402a6
so a backport to LTS branches should be considered because the initial
version of the buildroot package was 0.99.33, added with commit
f78280bf26.

An autobuilder error was not recorded yet because it is masked by various
build errors of the sane-backends package which are resolved by its bump
to 1.4.0 in this series.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit b71b14793a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-11 10:16:56 +02:00
Titouan Christophe
57a95f34b4 utils/bump-stable-kernel-versions: automatically commit result
Since this script is often used to bump kernel versions in multiple
Buildroot branches, it makes sense to simply commit changes directly
rather than letting the developer do it by hand.

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit fab50ed3b1)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-11 10:10:12 +02:00
Thomas Perale
366039c796 utils/generate-cyclonedx: fix hash_file location
The 'show-info' output always the location relative to the Buildroot
root directory.
When running 'generate-cyclonedx' outside of the Buildroot root
directory the hash file locations are not correct. Only using the
'hash_file' variable coming from 'show-info' doesn't guarantee the
script to succeed.

Use the 'brpath' variable to correctly reference the absolute path.

Fixes: 1791b79422 utils/generate-cyclonedx: add hashes from .hash files to externalReferences
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 2df4f1d573)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-11 10:09:59 +02:00
Peter Korsgaard
cf5072ec13 package/zsh: correct download URL after 5.9.1 release
Fixes:
https://autobuild.buildroot.net/results/9f0f50858b2f41c306f172bf011a34d2c0ad65dc/

>>> zsh 5.9 Downloading
wget -nd -t 3 --no-check-certificate -O '/home/autobuild/autobuild/instance-42/output-1/build/.zsh-5.9.tar.xz.FpXHXy/output' 'http://www.zsh.org/pub/zsh-5.9.tar.xz'
URL transformed to HTTPS due to an HSTS policy
--2026-06-01 01:46:35--  https://www.zsh.org/pub/zsh-5.9.tar.xz
Loaded CA certificate '/etc/ssl/certs/ca-certificates.crt'
Resolving www.zsh.org (www.zsh.org)... 94.142.241.90
Connecting to www.zsh.org (www.zsh.org)|94.142.241.90|:443... connected.
HTTP request sent, awaiting response... 404 Not Found
2026-06-01 01:46:36 ERROR 404: Not Found.

zsh-5.9.1 was released on 2026-05-31 and 5.9.0 release tarball moved under
old/, so update ZSH_SITE to match.

https://zsh.sourceforge.io/News/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 92cdec5a54)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-11 10:09:35 +02:00
Pengji Li
bdfdeea8e1 package/opencv4: respect LoongArch SIMD selection
OpenCV probes the host compiler for LSX/LASX by trying to compile a
small test program with '-mlsx' / '-mlasx'. With Buildroot's toolchain
this probe succeeds even when the target CPU lacks the matching ISA
extension, and the resulting libraries then contain LSX/LASX
instructions. This causes SIGILL at runtime on, e.g., the LA264.

Map Buildroot's BR2_LOONGARCH_SIMD_* selection to OpenCV's
CPU_BASELINE / CPU_DISPATCH knobs:

  BR2_LOONGARCH_SIMD_NONE  -> no baseline, no dispatch
  BR2_LOONGARCH_SIMD_LSX   -> baseline = LSX,  no dispatch
  BR2_LOONGARCH_SIMD_LASX  -> baseline = LSX,  dispatch = LASX

The block is gated on BR2_loongarch64, so the existing auto detection
remains in effect for every other architecture.

Signed-off-by: Pengji Li <wjjsn@qq.com>
Reviewed-by: Woodrow Douglass <wdouglass@carnegierobotics.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit b9d10eed1f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-11 10:09:08 +02:00
Bernd Kuhls
cf50153786 utils/bump-stable-kernel-versions: update for split hash file
Since Buildroot commit 0e3ddc9dc8,
linux hash files are split between pre- and post-6.17.

With buildroot commit da01b7271a the
script was updated for the new situation but still needs to update the
version-numbered links to the directories with the correct hash files.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit bd633fe5b4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-11 10:07:08 +02:00
Romain Naour
ee9086f30c support/testing: TestXfs: fix build on Gitlab runners
Our CI uses "/builds/buildroot.org/buildroot" as build directory.
Unlikely the xfsprogs build system misbehave when a directory in
the path contain ".o".

While generating .ltdep, the sed command used to convert object file
(.o) to libtool object(.lo) replace buildroot.org by buildroot.lorg.

  .ltdep: $(CFILES) $(HFILES)
    $(Q)$(MAKEDEP) $(CFILES) | $(SED) -e 's,^\([^:]*\)\.o,\1.lo,' > .ltdep

Building libfrog
    [CC]     gen_crc32table
    [GENERATE] crc32table.h
gmake[4]: *** No rule to make target '/builds/buildroot.lorg/buildroot/test-output/TestXfs/host/include/urcu.h', needed by 'avl64.lo'.  Stop.

Update the sed command to avoid this effect.

Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/14607335648

Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 0a9bc387b6)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-11 10:06:32 +02:00
Romain Naour
dd2469fa70 package/libmodsecurity: needs host-pkgconf
The configure script was regenerated for the 3.0.15 release but it now
error out if pkg-config is missing.

Add host-pkgconf in build dependency.

Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/14607335870 (TestNginxModsecurity)

Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit db75a8eea0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-11 10:05:52 +02:00
Bernd Kuhls
9191420db7 package/poppler: needs zlib
Buildroot commit cdd1c5ca55 bumped the
package from version 22.12.0 to 25.10.0 but forgot to change zlib into
a mandatory dependency. This is necessary due to upstream commit
7d87c7d2c6
since version 23.07.0.

Fixes:
https://autobuild.buildroot.net/results/85f/85fb6c2945101b8d4ee86dbc32700293e7b35a86/

CMake Error at /usr/share/cmake/Modules/FindPackageHandleStandardArgs.cmake:290 (message):
  Could NOT find ZLIB (missing: ZLIB_LIBRARY ZLIB_INCLUDE_DIR)
Call Stack (most recent call first):
  /usr/share/cmake/Modules/FindPackageHandleStandardArgs.cmake:654 (_FPHSA_FAILURE_MESSAGE)
  /usr/share/cmake/Modules/FindZLIB.cmake:242 (find_package_handle_standard_args)
  CMakeLists.txt:309 (find_package)

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 7a9486d7d6)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-11 10:05:29 +02:00
Thomas Perale
2121a13066 package/redis: update CPE vendor
The CPE "cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*" is valid for this
package.

See the GHSA [1] and the associated CVE [2].

[1] https://github.com/redis/redis/security/advisories/GHSA-c8h9-259x-jff4
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-25243

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 25601df83b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-05 14:41:59 +02:00
Shubham Chakraborty
40a3986edb package/util-linux: fix LSMT_ROOT fallback definition
The fallback definition for LSMT_ROOT was incorrectly guarded
with #ifdef instead of #ifndef, making it ineffective. This caused
build issues on configurations with musl 1.2.6, which defines
SYS_statmount making util-linux consider statmount() as available, but
having older kernel headers, not providing LSMT_ROOT.

Fixes:

  http://autobuild.buildroot.net/results/ac2bc633db0c605564c79bfdfa0e257a9b4f1b28/

Signed-off-by: Shubham Chakraborty <chakrabortyshubham66@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit f0540ff531)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-05 14:41:43 +02:00
John Ernberg
dee8d1caff package/pkg-generic: Add /usr/share/info/dir to $(2)_DROP_FILES_OR_DIRS
This is the file the original commit d889838098 ("package/pkg-generic.mk:
Remove Info documents dir entry") wanted to delete.

However, it only works for host packages. Target packages are (usually)
installed with prefix /usr, so the info dir is /usr/share/info. Simply
remove both of them, even if one of them only exists for host packages
and the other only for target packages.

Signed-off-by: John Ernberg <j@j-ernberg.se>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit e5a723f35d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-05 14:40:16 +02:00
Bernd Kuhls
3fbf04200d package/libheif: security bump version to 1.23.0
https://github.com/strukturag/libheif/releases/tag/v1.23.0
https://github.com/strukturag/libheif/security/advisories/GHSA-jvmp-j3cw-84mh

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit a72da6d7f5)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:29:57 +02:00
Bernd Kuhls
21e66bceac package/sshfs: security bump version to 3.7.6
https://github.com/libfuse/sshfs/blob/sshfs-3.7.6/ChangeLog.rst

Fixes CVE-2026-47187 & CVE-2026-48711.

Switched to sha256 tarball hash provided by upstream.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit c6ebe16f34)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:29:33 +02:00
Bernd Kuhls
3bc9358060 package/libpthsem: update project URL
The previous site went offline, the last entry dates back to April 2026:
https://web.archive.org/web/20260401000000*/http://www.auto.tuwien.ac.at/~mkoegler/pth/

Update _SITE to the bcusdk project which depends on libpthsem and stores
the original tarball. Update project URL to github mirror provided by the
linknx project which also depends on libpthsem.

Fixes download error:

ERROR: while checking hashes from package/libpthsem/libpthsem.hash
ERROR: pthsem_2.0.8.tar.gz has wrong sha256 hash:
ERROR: expected: 4024cafdd5d4bce2b1778a6be5491222c3f6e7ef1e43971264c451c0012c5c01
ERROR: got     : 01d9027268f27aab3ca5c6c649a7f7a444db5bc889e496d80c8704e4e120346e
ERROR: Incomplete download, or man-in-the-middle (MITM) attack

Fixes:
https://autobuild.buildroot.net/results/0d9/0d9e957540d15302ac55bc5a2207db0c45279b37/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit ec687c3b5c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:29:16 +02:00
Vincent Cruz
4ef6a58ad5 package/sysrepo: fix build on riscv32
Fixes:
  https://autobuild.buildroot.net/results/b0f/b0f30feeddad1a8d51ac87af8b7c56fd9a9b5ff6/build-end.log

Upstream: a0661b7e6a

Signed-off-by: Vincent Jardin <vjardin@free.fr>
Signed-off-by: Vincent Cruz <mooz@blockos.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 53941b55b2)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:28:27 +02:00
Bernd Kuhls
4f50149383 package/wireless-regdb: bump version to 2026.05.30
https://lists.infradead.org/pipermail/wireless-regdb/2026-May/001917.html

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit df127aec63)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:27:12 +02:00
Thomas Petazzoni
3edbe84c93 package/qt6/qt6base: remove SBOMs from target
All Qt6 packages install their own SPDX SBOM in
$(TARGET_DIR)/usr/lib/qt6/sbom/. In the context of Buildroot having
such SBOMs on the target is not useful, and they take up some space,
so get rid of them.

We use a TARGET_FINALIZE_HOOKS (and not a POST_INSTALL_TARGET_HOOKS)
because it's not just qt6base that installs SBOMs, but all qt6
modules, so we want the cleanup to happen after they all got
installed.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 160ef0b27a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:26:20 +02:00
Thomas Petazzoni
7e30510882 package/qt6/qt6base: use regular $(RM) to remove directory
Using '$(Q)rm -rf' is not the typical thing we do in Buildroot, we
more commonly use '$(RM) -rf'.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 45789c73b1)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:26:02 +02:00
Titouan Christophe
4da098bc7d package/samba4: fix build on uclibc with GCC 14+
iconv types are defined differently in glibc (as pointers) and uclibc
(as integers). With changes in GCC14, -Wint-conversion has now become
an error, which shed some light on the issue.

The actual fix for that problem is released in uclibc 1.0.58 [1].
However, because these type definitions are in toolchain headers,
this means that the toolchain used to build samba must also include
uclibc>=1.0.58 (either an external toolchain that includes the uclibc fix,
or a Buildroot toolchain after the uclibc fix is merged in Buildroot [2]).

Until then, provide a workaround for samba itself.

No autobuilder failure on this (yet). It can be reproduced with
    > ./utils/test-pkg -p samba4 -T bootlin-armv5-uclibc

[1] 328e14e55f
[2] https://lore.kernel.org/buildroot/ahPrm_0gVDGw5B5-@waldemar-brodkorb.de/

Assisted-by: Claude:claude-opus-4.8
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit e136494e91)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:25:41 +02:00
Bernd Kuhls
ef803515ae package/lua-sdl2: fix cmake 4 compatibility
Fixes:
https://autobuild.buildroot.net/results/f75/f75d1d0b83c90c0cb5dc7781ea8ce7ff1d67512a/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit ce3b3bf876)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:25:21 +02:00
Bernd Kuhls
8f26816379 package/mrp: fix cmake 4 compatibility
Fixes:
https://autobuild.buildroot.net/results/d93/d938025a881a14003c1b50065f163115e36cf33e/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Reviewed-by: Horatiu Vultur <horatiu.vultur@microchip.com>
Reviewed-by: Michael Cullen <michael@michaelcullen.name>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 299567b78e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:25:01 +02:00
Bernd Kuhls
aed5d21b8c package/crucible: needs NPTL
gcc_stack_unix.c: In function 'x_cgo_getstackbound':
gcc_stack_unix.c:28:9: error: implicit declaration of function 'pthread_getattr_np';
 did you mean 'pthread_attr_init'? [-Wimplicit-function-declaration]
   28 |         pthread_getattr_np(pthread_self(), &attr);  // GNU extension

Fixes:
https://autobuild.buildroot.net/results/e07/e07198d7864331027d21cd2109054d86e7ac1c3d/

The build error also occured in Oct 2024 so a backport to buildroot
LTS branches should be considered:
https://autobuild.buildroot.net/results/ebb/ebbd051010c27f97fafc0b203b22c8b0af7e5ccd/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 1eeed7e978)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:24:47 +02:00
Peter Korsgaard
9020246070 package/sdl2_image: security bump to version 2.8.12
Fixes the following security issue (in 2.8.10):

CVE-2026-35444: Heap buffer overflow READ via unchecked colormap index in
XCF loader

https://github.com/libsdl-org/SDL_image/security/advisories/GHSA-gq8w-x74c-h6p7

In addition, 2.8.12 includes a number of memory related bugfixes:

Fixed memory overflow with corrupt LBM image
Fixed crash when decoding an invalid XCF image
Fixed out of bound read in GIF decoder

Update hash of license file for change of copyright year with:
281b4ebcb0

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 7769710087)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:24:27 +02:00
Peter Korsgaard
921ba9e357 boot/arm-trusted-firmware: correct cpe-id version logic
Commit 53bb7eafb2 ("package/arm-trusted-firmware: add
ARM_TRUSTED_FIRMWARE_CPE_ID_*") added logic to set the cpe-id version from
the package version by dropping a v or lts- prefix, but it used subst
instead of patsubst - So it would replace "v" and "lts-" anywhere in the
version and not only in the beginning of it.

Change to patsubst to fix that.

E.G. with the following defconfig:
BR2_aarch64=y
BR2_TARGET_ARM_TRUSTED_FIRMWARE=y
BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_VERSION=y
BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_VERSION_VALUE="version-with-v-or-lts-in-it"

before:
make printvars VARS=ARM_TRUSTED_FIRMWARE_CPE_ID_VERSION
ARM_TRUSTED_FIRMWARE_CPE_ID_VERSION=ersion-with--or-in-it

after:
make printvars VARS=ARM_TRUSTED_FIRMWARE_CPE_ID_VERSION
ARM_TRUSTED_FIRMWARE_CPE_ID_VERSION=ersion-with-v-or-lts-in-it

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit e60515bbf5)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:24:00 +02:00
Bernd Kuhls
1f559e5c46 package/stellarium: add extra downloads
Building Stellarium includes the download of external tarballs during
configure.

This fails with host-cmake during configure stage:

CMake Error at md4c-subbuild/md4c-populate-prefix/src/md4c-populate-stamp/download-md4c-populate.cmake:163 (message):
  Each download failed!

    error: downloading 'https://github.com/mity/md4c/archive/refs/tags/release-0.5.2.tar.gz' failed
          status_code: 1
          status_string: "Unsupported protocol"
          log:
          --- LOG BEGIN ---
          Protocol "https" not supported

  closing connection #-1

due to buildroot commit f87138339b which
disabled SSL support for host-cmake.

This patch uses _EXTRA_DOWNLOADS to provide these tarball to allow
offline builds.

No autobuilder error was recorded, the build error can be reproduced
with this defconfig:

BR2_x86_64=y
BR2_x86_corei7=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_X86_64_CORE_I7_GLIBC_BLEEDING_EDGE=y
BR2_FORCE_HOST_BUILD=y
BR2_PACKAGE_STELLARIUM=y
BR2_PACKAGE_MESA3D=y
BR2_PACKAGE_MESA3D_GALLIUM_DRIVER_SOFTPIPE=y
BR2_PACKAGE_MESA3D_OPENGL_GLX=y
BR2_PACKAGE_QT5=y
BR2_PACKAGE_XORG7=y

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 646ea396c1)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:23:14 +02:00
Bernd Kuhls
641ae239a7 package/stellarium: fix qt5serialport dependency
qt5serialport is only needed when GPS support is enabled:
https://github.com/Stellarium/stellarium/blob/v25.4/CMakeLists.txt#L623,
so having qt5serialport without gpsd doesn't bring anything.

Please note that we disable telescope support by default so only gpsd
enables the usage of qt5serialport.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 8e2238ccce)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:19:16 +02:00
Thomas Petazzoni
d2910d1322 package/php: propagate postgresql dependencies properly
Commit 9e7172ceac bumped postgresql and
had to disable postgresql on Sparc. This dependency was unfortunately
not properly propagated to BR2_PACKAGE_PHP_EXT_PDO_POSTGRESQL, causing
the following Kconfig warning:

WARNING: unmet direct dependencies detected for BR2_PACKAGE_POSTGRESQL
  Depends on [n]: BR2_USE_MMU [=y] && !BR2_sparc [=y] && BR2_USE_WCHAR [=y] && BR2_ENABLE_LOCALE [=y] && BR2_TOOLCHAIN_HAS_THREADS_NPTL [=y] && !BR2_STATIC_LIBS [=n] && !BR2_OPTIMIZE_FAST [=n]
  Selected by [y]:
  - BR2_PACKAGE_PHP_EXT_PDO_POSTGRESQL [=y] && BR2_PACKAGE_PHP [=y] && BR2_PACKAGE_PHP_EXT_PDO [=y] && BR2_USE_MMU [=y] && BR2_USE_WCHAR [=y] && BR2_ENABLE_LOCALE [=y] && BR2_TOOLCHAIN_HAS_THREADS_NPTL [=y] && !BR2_STATIC_LIBS [=n] && !BR2_OPTIMIZE_FAST [=n]

We fix this by properly propagating the dependency.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit e139c36925)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:18:56 +02:00
Thomas Petazzoni
8b6eeca158 package/liburing: properly handle VERSION vs. SITE
VERSION should ideally contain only the version, i.e 2.12 and not some
additional prefix like liburing- as it prevents our logic matching
against release-monitoring.org data to work properly.

Fixes: d2ed456532 ("package/liburing: bump to version 2.12")
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit 8e2d15cb76)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:18:19 +02:00
Bernd Kuhls
e3ccc1eaed package/lrzsz: fix build with gcc >= 14.x
Fixes:
https://autobuild.buildroot.net/results/2e3/2e33c61e1c9bee099f973c1e43b696c63e5eed4b/

Building lrzsz with this defconfig works:

BR2_GCC_VERSION_13_X=y
BR2_PACKAGE_LRZSZ=y

and gets broken when switched to gcc 14:

BR2_PACKAGE_LRZSZ=y

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 28e52cde51)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:17:27 +02:00
Quentin Schulz
c304683bf9 package/qt5/qt5webengine-chromium: fix zlib license hash
Commit c53455ea4f ("package/qt5/qt5webengine-chromium: bump version
after qtwebengine bump") bumped qt5webengine-chromium but forgot to
update the licenses.

The diff of the license is reported by
git diff 0ad2814370799a2161057d92231fe3ee00e2fe98..18c9261dc5b8aa57a0bdd5b62ce6f648cca1ef5e -- chromium/third_party/zlib/LICENSE
as the following:

  diff --git a/chromium/third_party/zlib/LICENSE b/chromium/third_party/zlib/LICENSE
  index 9f056865b57..8aca25d8c7a 100644
  --- a/chromium/third_party/zlib/LICENSE
  +++ b/chromium/third_party/zlib/LICENSE
  @@ -1,6 +1,6 @@
  -version 1.2.11, January 15th, 2017
  +version 1.2.12, March 27th, 2022

  -Copyright (C) 1995-2017 Jean-loup Gailly and Mark Adler
  +Copyright (C) 1995-2022 Jean-loup Gailly and Mark Adler

   This software is provided 'as-is', without any express or implied
   warranty.  In no event will the authors be held liable for any damages

so it doesn't change its actual license, let's simply fix the sha256 to
the new value.

Fixes: c53455ea4f ("package/qt5/qt5webengine-chromium: bump version after qtwebengine bump")
Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 2deee0c87d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:13:53 +02:00
Quentin Schulz
14772e02f9 package/qt5/qt53d: always disable assimp support
Neither Buildroot's nor the module from qt53d sources compile, so always
disable assimp support.

Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 11e380fb03)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:13:48 +02:00
Quentin Schulz
4781035ebd package/qt5/qt53d: force using Buildroot's assimp when selected
If we're adding a dependency to the package, it's for its build system
to use it. Unfortunately, when -feature-system-assimp is not passed, the
assimp module from the sources will be used. Moreover, it doesn't build
currently.

Unfortunately, qt53d still doesn't build with assimp from Buildroot.

Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 79b13f6e67)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:13:43 +02:00
Quentin Schulz
44ca25220b package/qt5/qt53d: disable assimp support when BR2_PACKAGE_ASSIMP is not set
If we don't disable it, the assimp module from the sources will be used
instead of none. Unfortunately, it currently doesn't build so let's
disable it when BR2_PACKAGE_ASSIMP is not set such that one can still
build qt53d.

Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit bc1a1dfece)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:13:39 +02:00
Bernd Kuhls
f243d6b151 package/cairo: Fix build
Buildroot commit 29888ab35e bumped cairo
to version 1.18.2.

This version includes commit
87f7c60bf7
"Add support for C11 atomics"

which causes build errors:

../src/cairo-image-source.c: In function '_pixman_transparent_image':
../src/cairo-image-source.c:89:40: error: passing argument 1 of '_cairo_atomic_ptr_cmpxchg_impl'
 from incompatible pointer type [-Wincompatible-pointer-types]
   89 |         if (_cairo_atomic_ptr_cmpxchg (&__pixman_transparent_image,

Fixes:
1.18.2: https://autobuild.buildroot.net/results/5d4/5d4cd38d71008f385f92577b07f21dcfc3c19b38/
1.18.4: https://autobuild.buildroot.net/results/0e9/0e962c66e1e96b5899e87c13ace824379adc09f9/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit b90127ee71)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:11:25 +02:00
Bernd Kuhls
ead1a5b605 package/xerces: fix build with recent versions of ICU
Since Buildroot commit dcee99507c in
2025.11-rc1 that bumped package/icu to version 77-1, the build of xerces
with ICU support enabled fails:

In file included from /home/bernd/buildroot/output/host/i586-buildroot-linux-gnu/sysroot/usr/include/unicode/uset.h:38,
                 from /home/bernd/buildroot/output/build/xerces-3.3.0/src/xercesc/util/regx/RangeToken.cpp:40:
/home/bernd/buildroot/output/host/i586-buildroot-linux-gnu/sysroot/usr/include/unicode/char16ptr.h:271:55:
 error: 'is_same_v' is not a member of 'std'; did you mean 'is_same'?

Indeed, ICU now requires C++17. Instead of using a patch from Gentoo[1]
we use a backported upstream commit, limited to CMakeLists.txt, to raise
the c++ version.

The build error was not recorded yet by the autobuilders but can be
reproduced with this defconfig:

BR2_TOOLCHAIN_BUILDROOT_CXX=y
BR2_PACKAGE_XERCES=y
BR2_PACKAGE_ICU=y

[1] https://bugs.gentoo.org/931105

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 7d4e403f02)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:10:51 +02:00
Bernd Kuhls
d60cf9b1c6 package/libbpf: fix bpftrace build with kernel headers 6.0
Buildroot commit 97e2f63bdf bumped
bpftrace from 0.23.3 to 0.24.2.

This release includes upstream commit
7578314df6
which was added to version 0.24.0 and makes use of
bpf_iter_link_info.task that was added to the linux kernel in version
6.1:
f0d74c4da1

causing build errors when the toolchain contains kernel headers version
6.0 because the libbpf package does not update their headers:

output/build/bpftrace-0.24.2/src/attached_probe.cpp: In static member
 function 'static bpftrace::Result<std::unique_ptr<bpftrace::AttachedIterProbe> >
 bpftrace::AttachedIterProbe::make(bpftrace::Probe&,
 const bpftrace::BpfProgram&, std::optional<int>)':
output/build/bpftrace-0.24.2/src/attached_probe.cpp:1437:11: error:
 'union bpf_iter_link_info' has no member named 'task'
 1437 |     linfo.task.pid = *pid;

The build error can be reproduced with this defconfig

BR2_aarch64=y
BR2_KERNEL_HEADERS_VERSION=y
BR2_DEFAULT_KERNEL_VERSION="6.0.19"
BR2_PACKAGE_HOST_LINUX_HEADERS_CUSTOM_6_0=y
BR2_TOOLCHAIN_BUILDROOT_CXX=y
BR2_PER_PACKAGE_DIRECTORIES=y
BR2_PACKAGE_BPFTRACE=y

on the 2026.02.x branch as of 0be927b89a.

Fixes:
https://autobuild.buildroot.net/results/146/14671c54fdf0a2e44bcce7ff61ca9b89a925eca9/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 513f800cf3)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:10:30 +02:00
Bernd Kuhls
280270c932 package/libbpf: fix bpftrace build with kernel headers > 5.11 & < 6.0
Buildroot commit 97e2f63bdf in 2026.02-rc1
bumped bpftrace from 0.23.3 to 0.24.2.

This release includes upstream commit
d4f5838227

which was added to version 0.24.0 and makes use of btf_enum64 that was
added to the linux kernel in version 6.0:
6089fb325c

causing build errors when the toolchain contains kernel headers between
versions 5.12 and 5.19 because the libbpf package does not update their
headers so we need to raise the BR2_TOOLCHAIN_HEADERS_AT_LEAST_ version
number again.

The build error can be reproduced with this defconfig

BR2_aarch64=y
BR2_KERNEL_HEADERS_VERSION=y
BR2_DEFAULT_KERNEL_VERSION="5.11.22"
BR2_PACKAGE_HOST_LINUX_HEADERS_CUSTOM_5_11=y
BR2_TOOLCHAIN_BUILDROOT_CXX=y
BR2_PER_PACKAGE_DIRECTORIES=y
BR2_PACKAGE_BPFTRACE=y

on the 2026.02.x branch as of 0be927b89a.

Fixes:
https://autobuild.buildroot.net/results/8f7/8f7ce88a070e825ef178275a13d969349f05593b/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 7102aa5ffd)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:10:03 +02:00
Bernd Kuhls
7b9b53d1be package/libbpf: fix bpftrace build with kernel headers 5.{9, 10}
Buildroot added the bpftrace package in 2024 with commit
338acb27ff
which initially provided version 0.19.1.

This release includes upstream commit
fea3193989
which was added to version 0.17.0 in 2022 and makes use of certain
variables of struct bpf_btf_info which were added to the linux kernel in
2020 with version 5.11:
5329722057

+	__aligned_u64 name;
+	__u32 name_len;
+	__u32 kernel_btf;

The libbpf package updates toolchain headers with its bundled version
only when the toolchain headers are version 5.8 or older, this condition
is part of the initial version of the package added in 2020 with
buildroot commit f7b8508e4f. This version
limit should have been raised when the bpftrace package was added to
avoid build errors when the toolchain contains header versions 5.9 or
5.10.

This situation caused build errors in the autobuilder, the last one in
February 2025:

/home/autobuild/autobuild/instance-18/output-1/build/bpftrace-0.19.1/src/bpffeature.cpp:
 In member function 'bool bpftrace::BPFfeature::has_module_btf()':
/home/autobuild/autobuild/instance-18/output-1/build/bpftrace-0.19.1/src/bpffeature.cpp:573:8:
 error: 'struct bpf_btf_info' has no member named 'name'
  573 |   info.name = (__u64)name;
      |        ^~~~
/home/autobuild/autobuild/instance-18/output-1/build/bpftrace-0.19.1/src/bpffeature.cpp:574:8:
 error: 'struct bpf_btf_info' has no member named 'name_len'
  574 |   info.name_len = sizeof(name);

The problem disappeared from the autobuilders due to newer headers
versions used for the buildroot toolchain or other build errors occurring
earlier, like llvm version mismatches.

The build error can today still be reproduced with this defconfig

BR2_aarch64=y
BR2_KERNEL_HEADERS_5_10=y
BR2_TOOLCHAIN_BUILDROOT_CXX=y
BR2_PER_PACKAGE_DIRECTORIES=y
BR2_PACKAGE_BPFTRACE=y

on the 2026.02.x branch as of 0be927b89a.

To fix the problem we raise the BR2_TOOLCHAIN_HEADERS_AT_LEAST_ version
number.

Fixes:
https://autobuild.buildroot.net/results/dbe/dbecf88c7edba357cee8fea31294ddb9f4d188ad/
https://autobuild.buildroot.net/results/df5/df59e038de47f63d14e1be7bd12dd16a69636f79/
https://autobuild.buildroot.net/results/359/3595d39dd53a686bbf996dd4e532ced44906b9e3/
https://autobuild.buildroot.net/results/e4f/e4f95a5f30a605eadb81802075ea6bb1e2880684/
https://autobuild.buildroot.net/results/bd0/bd075cb8c55f9f8a017711dc804b8d81ae89b4c5/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 7e5241e14a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:09:33 +02:00
Bernd Kuhls
49cc5deacd package/bpftrace: fix build with per-package directories
Buildroot commit f7b8508e4f in 2021.08-rc1
added the libbpf package which contains the usage of the
'install_uapi_headers' make target to update toolchain headers older
than kernel version 5.9.  This does not work with per-package
directories.

Building this defconfig that includes all packages depending on libbpf:

  BR2_x86_64=y
  BR2_x86_rocketlake=y
  BR2_KERNEL_HEADERS_VERSION=y
  BR2_DEFAULT_KERNEL_VERSION="5.8.18"
  BR2_PACKAGE_HOST_LINUX_HEADERS_CUSTOM_5_8=y
  BR2_TOOLCHAIN_BUILDROOT_CXX=y
  BR2_PER_PACKAGE_DIRECTORIES=y
  BR2_PACKAGE_BPFTRACE=y
  BR2_PACKAGE_DPDK=y
  BR2_PACKAGE_IPROUTE2=y
  BR2_PACKAGE_HOST_PAHOLE=y

on the 2026.02.x branch as of 0be927b89a
is broken:

output/build/bpftrace-0.24.2/src/attached_probe.cpp: In static member
 function 'static bpftrace::Result<std::unique_ptr<bpftrace::AttachedIterProbe> >
 bpftrace::AttachedIterProbe::make(bpftrace::Probe&,
 const bpftrace::BpfProgram&, std::optional<int>)':
output/build/bpftrace-0.24.2/src/attached_probe.cpp:1435:30: error:
 aggregate 'bpf_iter_link_info linfo' has incomplete type and cannot be
 defined
 1435 |     union bpf_iter_link_info linfo;

libbpf overwrites kernel header files installed in $STAGING_DIR when
they are too old by adding 'install_uapi_headers' as make target. In
the case of per-package directories these header files are stored only
in output/per-package/libbpf/.

When output/per-package/bpftrace/ is populated, the content of
output/per-package/ from other packages overwrites the header files
installed by libbpf because the list of rsync'ed packages is sorted
alphabetically:
https://gitlab.com/buildroot.org/buildroot/-/blob/2026.02.1/package/pkg-generic.mk#L796

To prevent this problem let libbpf install the updated kernel headers in
a new directory.

Other packages need to find this directory. This mostly happens through
pkg-config, but bpftrace doesn't use that:
https://github.com/bpftrace/bpftrace/blob/v0.25.1/cmake/FindLibBpf.cmake#L9
Therefore, use a configure option in bpftrace to set the correct path.

Please note that libbpf will add '/linux' to the path provided in
$UAPIDIR:
https://github.com/libbpf/libbpf/blob/v1.7.0/src/Makefile#L169
so the headers end up in the previously non-existing directory
$(STAGING_DIR)/usr/include/bpf/linux/:

$ find output/per-package/libbpf/host/x86_64-buildroot-linux-gnu/sysroot/ -iname bpf.h -exec ls -lao {} \;
-rw-r--r-- 1 bernd 26434 25. Apr 13:15 output/per-package/libbpf/host/x86_64-buildroot-linux-gnu/sysroot/usr/include/bpf/bpf.h
-rw-r--r-- 1 bernd 283012 25. Apr 13:15 output/per-package/libbpf/host/x86_64-buildroot-linux-gnu/sysroot/usr/include/bpf/linux/bpf.h
-rw-r--r-- 12 bernd 160166 25. Apr 13:08 output/per-package/libbpf/host/x86_64-buildroot-linux-gnu/sysroot/usr/include/linux/bpf.h

bpf.h with 283012 bytes is the update-to-date version needed for bpftrace:

$ grep -m1 bpf_iter_link_info output/per-package/libbpf/host/x86_64-buildroot-linux-gnu/sysroot/usr/include/bpf/linux/bpf.h
union bpf_iter_link_info {
$

$ grep -m1 bpf_iter_link_info output/per-package/libbpf/host/x86_64-buildroot-linux-gnu/sysroot/usr/include/linux/bpf.h
$

By adding '-I$(STAGING_DIR)/usr/include/bpf' to the CXXFLAGS of bpftrace
its include finds the correct header:
https://github.com/bpftrace/bpftrace/blob/v0.25.1/src/bpfprogram.cpp#L3

  #include <linux/bpf.h>

The dpdk package uses pkg-config` to detect libbpf and will use the updated
.pc file:
https://github.com/DPDK/dpdk/blob/v25.11/drivers/net/tap/bpf/meson.build#L7

The iproute2 package is not affected by the problem because it contains
"matching sanitized kernel headers":
https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/tree/README?h=v6.17.0#n44

As a host package pahole is also not affected.

Fixes:
https://autobuild.buildroot.net/results/d8b/d8b416e40bf7bd019cd93e6f2d42c98fc12d4160/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit f07fb2bcd2)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:08:49 +02:00
Bernd Kuhls
c46e011a52 package/bpftrace: remove configure option INSTALL_TOOL_DOCS
Buildroot commit 97e2f63bdf in 2026.02-rc1
bumped the package to 0.24.2 but forgot to remove the configure option
INSTALL_TOOL_DOCS which was removed upstream in version 0.24.0:
579e0e9dfe

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 7716db8a12)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:08:30 +02:00
Bernd Kuhls
84c94299d0 package/bpftrace: remove configure option USE_SYSTEM_BPF_BCC
Buildroot commit 305c40613c in 2025.08-rc1
bumped the package to 0.23.3 but forgot to remove the configure option
USE_SYSTEM_BPF_BCC which was removed upstream in version 0.20.0:
ef6d9d42d3

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit d2bd5b0a51)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:08:10 +02:00
Quentin Schulz
5b4f9325eb utils/generate-cyclonedx: hint at missing Buildroot host package on a specific error
Since last commit, utils/generate-cyclonedx can now be used with
Buildroot host tools, provided the user either externally install the
SPDX schema in the DL_DIR themselves or have
BR2_PACKAGE_HOST_PYTHON3_SSL and BR2_PACKAGE_HOST_CA_CERTIFICATES both
enabled. If the latter is missing, Python will complain with:

Traceback (most recent call last):
  File "/buildroot/build/host/lib/python3.14/urllib/request.py", line 1321, in do_open
    h.request(req.get_method(), req.selector, req.data, headers,
    ~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
              encode_chunked=req.has_header('Transfer-encoding'))
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/buildroot/build/host/lib/python3.14/http/client.py", line 1358, in request
    self._send_request(method, url, body, headers, encode_chunked)
    ~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/buildroot/build/host/lib/python3.14/http/client.py", line 1404, in _send_request
    self.endheaders(body, encode_chunked=encode_chunked)
    ~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/buildroot/build/host/lib/python3.14/http/client.py", line 1353, in endheaders
    self._send_output(message_body, encode_chunked=encode_chunked)
    ~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/buildroot/build/host/lib/python3.14/http/client.py", line 1113, in _send_output
    self.send(msg)
    ~~~~~~~~~^^^^^
  File "/buildroot/build/host/lib/python3.14/http/client.py", line 1057, in send
    self.connect()
    ~~~~~~~~~~~~^^
  File "/buildroot/build/host/lib/python3.14/http/client.py", line 1499, in connect
    self.sock = self._context.wrap_socket(self.sock,
                ~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^
                                          server_hostname=server_hostname)
                                          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/buildroot/build/host/lib/python3.14/ssl.py", line 455, in wrap_socket
    return self.sslsocket_class._create(
           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~^
        sock=sock,
        ^^^^^^^^^^
    ...<5 lines>...
        session=session
        ^^^^^^^^^^^^^^^
    )
    ^
  File "/buildroot/build/host/lib/python3.14/ssl.py", line 1076, in _create
    self.do_handshake()
    ~~~~~~~~~~~~~~~~~^^
  File "/buildroot/build/host/lib/python3.14/ssl.py", line 1372, in do_handshake
    self._sslobj.do_handshake()
    ~~~~~~~~~~~~~~~~~~~~~~~~~^^
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1081)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/buildroot/utils/generate-cyclonedx", line 53, in <module>
    urllib.request.urlretrieve(SPDX_SCHEMA_URL, SPDX_SCHEMA_PATH)
    ~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/buildroot/build/host/lib/python3.14/urllib/request.py", line 212, in urlretrieve
    with contextlib.closing(urlopen(url, data)) as fp:
                            ~~~~~~~^^^^^^^^^^^
  File "/buildroot/build/host/lib/python3.14/urllib/request.py", line 187, in urlopen
    return opener.open(url, data, timeout)
           ~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^
  File "/buildroot/build/host/lib/python3.14/urllib/request.py", line 487, in open
    response = self._open(req, data)
  File "/buildroot/build/host/lib/python3.14/urllib/request.py", line 504, in _open
    result = self._call_chain(self.handle_open, protocol, protocol +
                              '_open', req)
  File "/buildroot/build/host/lib/python3.14/urllib/request.py", line 464, in _call_chain
    result = func(*args)
  File "/buildroot/build/host/lib/python3.14/urllib/request.py", line 1369, in https_open
    return self.do_open(http.client.HTTPSConnection, req,
           ~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
                        context=self._context)
                        ^^^^^^^^^^^^^^^^^^^^^^
  File "/buildroot/build/host/lib/python3.14/urllib/request.py", line 1324, in do_open
    raise URLError(err)
urllib.error.URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1081)>

Provide some hint as to what could be missing from Buildroot host.

Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 17c9deb115)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:07:55 +02:00
Quentin Schulz
ce4a8e5d07 utils/generate-cyclonedx: better error message when host Python is built without ssl
urllib will eventually complain that it does not know what https is:
Traceback (most recent call last):
  File "/buildroot/utils/generate-cyclonedx", line 53, in <module>
    urllib.request.urlretrieve(SPDX_SCHEMA_URL, SPDX_SCHEMA_PATH)
    ~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/buildroot/build/host/lib/python3.14/urllib/request.py", line 212, in urlretrieve
    with contextlib.closing(urlopen(url, data)) as fp:
                            ~~~~~~~^^^^^^^^^^^
  File "/buildroot/build/host/lib/python3.14/urllib/request.py", line 187, in urlopen
    return opener.open(url, data, timeout)
           ~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^
  File "/buildroot/build/host/lib/python3.14/urllib/request.py", line 487, in open
    response = self._open(req, data)
  File "/buildroot/build/host/lib/python3.14/urllib/request.py", line 509, in _open
    return self._call_chain(self.handle_open, 'unknown',
           ~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
                            'unknown_open', req)
                            ^^^^^^^^^^^^^^^^^^^^
  File "/buildroot/build/host/lib/python3.14/urllib/request.py", line 464, in _call_chain
    result = func(*args)
  File "/buildroot/build/host/lib/python3.14/urllib/request.py", line 1397, in unknown_open
    raise URLError('unknown url type: %s' % type)
urllib.error.URLError: <urlopen error unknown url type: https>

It's quite confusing really but what it means is that host Python was
built without ssl support.

This adds an additional check importing _ssl and if the module is not
found, tell the user what to do. This still doesn't make Buildroot's
host Python3 fully usable for utils/generate-cyclonedx as it'll then
fail when trying to validate certificates, this will be handled in the
next few commits.

Note that ssl Python library is always built in CPython, but itself
imports the _ssl module which is the one that may be disabled with
py_cv_module__ssl=n/a (which is what happens when
BR2_PACKAGE_HOST_PYTHON3_SSL is not enabled), hence why _ssl is checked
and not ssl.

Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 3e2df83809)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:07:46 +02:00
Quentin Schulz
7c7b4e3333 utils/generate-cyclonedx: remove "support" for bz2 and gzip compressed patches
Buildroot-local patches can only be suffixed by .patch, otherwise they
either need to be downloaded via <PKG>_PATCH or manually applied via
$(APPLY_PATCHES) in a <PKG>_{PRE,POST}_PATCH_HOOKS like in
linux/linux.mk. In the former case, they are then listed in the
show-info output with a full URL (prefixed by '<PKG>_SITE_METHOD+'). In
the latter case, they not listed as patches at the moment, just as
externalReferences.

By removing "support" for those compressed patches, we can avoid the bz2
dependency and can now use Buildroot's host-python3 package without
BR2_PACKAGE_HOST_PYTHON3_BZIP2 to run utils/generate-cyclonedx.

Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 0b70e16d5a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:07:40 +02:00
Heiko Stuebner
3c6a6df8a4 package/arm-trusted-firmware: add ARM_TRUSTED_FIRMWARE_CPE_ID_*
Trusted-Firmware has been using a number of CPE identifiers in the past
but especially after v2.4, the correct identifier would be similar
to cpe:2.3:o:arm:trusted_firmware-a:2.12:rc0:*:*:-:*:*:*

  https://nvd.nist.gov/products/cpe/detail/65DEC230-1CD5-40DB-903A-22537D1E44FE

Add the relevant CPE fields to the trusted-firmware package.

Signed-off-by: Heiko Stuebner <heiko.stuebner@cherry.de>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 53bb7eafb2)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:06:50 +02:00
Bernd Kuhls
938478b64d package/collectd: fix wchar dependency of mariadb
Fmt depends on BR2_USE_WCHAR since its introduction in 2017 by buildroot
commit 81fe75c855.

Buildroot commit 821f9dee81 added fmt as
dependency to mariadb in July 2023, including the wchar dependency.

Buildroot commit 8708f3a23a from March
2024, which replaced the mysql virtual package with mariadb, causes
build errors due to the wchar dependency not being propagated.

Fixes:
https://autobuild.buildroot.net/results/ef2/ef201a7d04330463ce46b93e6d5702dfefc6ad6c/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 58b9eb270e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:06:30 +02:00
Martin Willi
81570acfb4 utils/generate-cyclonedx: generate vcs externalReferences for source repos
Some packages do not have a http/https download URL for a source tarball,
but are acquired over a version control system like git. If so, add
externalReferences of type "vcs" for such URLs.

As most git repositories use a https:// transport that may not indicated the
repository type, add a "comment" due to the lack of a better mechanism in
CycloneDX.

While the hashes are calculated over a tarball created locally, it still may
be useful, so add them for "vcs" externalReferences as well.

Signed-off-by: Martin Willi <martin@strongswan.org>
Acked-By: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit e8c54ffb3d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:05:59 +02:00
Martin Willi
42728a945b utils/generate-cyclonedx: add hashes from .hash files to externalReferences
BSI TR-03183-2 5.2.5 [1] lists the "Hash value of the source code of the
component" under "Optional data fields for each component", and as such
CycloneDX "MAY additionally include the [...] information, if it exists".

As hash values are available in Buildroot, iterate over .hash file paths
from show-info input and read hash values for the source distribution. Add
all found hashes to externalReferences source-distribution entries.

[1] https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/TechGuidelines/TR03183/BSI-TR-03183-2_v2_1_0.pdf?__blob=publicationFile&v=5

Signed-off-by: Martin Willi <martin@strongswan.org>
Acked-By: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 1791b79422)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:05:51 +02:00
Martin Willi
d32ced8e4e package/pkg-utils: add 'hashes' to show-info
Finding the hash file for a package is non-trivial, as they can be in a
<version> sub-directory or under GLOBAL_PATCH_DIR. To allow other tools
such as utils/generate-cyclonedx to find hash files, expose this information
from show-info. If a package does not provide a hash file, create an
empty hashes array.

Suggested-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Martin Willi <martin@strongswan.org>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 619d44b23a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:05:44 +02:00
Martin Willi
860d1de569 utils/generate-cyclonedx: generate externalReferences with source-distribution
BSI TR-03183-2 5.4.2 [1] lists source code URIs under "Additional data fields
for each component", and as such "MUST additionally be provided, if it exists".

If a http or https source download URI is available from show-info, extract
it and include it as an externalReference of type "source-distribution" in the
CycloneDX output.

[1] https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/TechGuidelines/TR03183/BSI-TR-03183-2_v2_1_0.pdf?__blob=publicationFile&v=5

Signed-off-by: Martin Willi <martin@strongswan.org>
Acked-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit e4f0fb126d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:05:37 +02:00
Martin Willi
6ba3a06969 utils/generate-cyclonedx: remove indirect dependencies from root component
Commit dc4af8bfa9 ("utils/generate-cyclonedx: use direct dependencies")
removes indirect dependencies from any listed component, as required by
CycloneDX. The root component, however, still includes indirect dependencies,
as it just takes the components from the show-info output.

Fix this by collecting all component dependencies, and then filter the root
component dependencies to include direct dependencies only.

Signed-off-by: Martin Willi <martin@strongswan.org>
Acked-By: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit cc41cc3fcd)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:05:30 +02:00
Martin Willi
063a47f2aa support/testing/utils: add basic tests for utils/generate-cyclonedx
Introduce unit-tests for the generate-cyclonedx script, covering basic
script invocation, patch CVE extraction and virtual packages.

Signed-off-by: Martin Willi <martin@strongswan.org>
Acked-By: Thomas Perale <thomas.perale@mind.be>
[Arnout: fix check-package errors]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 929e7cb005)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:05:24 +02:00
Dario Binacchi
cd2659ba04 package/babeld: disable for musl toolchains
Building babeld with a musl toolchain fails with:
  ld: read-only segment has dynamic relocations

This happens because babeld uses text relocations (textrels), which
are not supported by the musl dynamic loader and would cause a
runtime crash (segmentation fault).

Since Buildroot passes '-ztext' to detect these unsafe relocations
at build time, disable babeld entirely for musl configurations.

Fixes:
https://autobuild.buildroot.org/results/c75643713fd5f27fe063c226630680d26a8b9487/

Suggested-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit a01c1258fe)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:05:04 +02:00
Bernd Kuhls
4d3c8925b0 package/cups-filters: add upstream patch to fix CVE-2025-64524
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: add "CVE:" tag in patch]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit ddde78c1bd)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:04:27 +02:00
Thomas Petazzoni
5a29ec02f6 package/util-linux/util-linux-libs: add AUTORECONF
Commit dd4161c39d ("package/util-linux:
optionally add libpthread to uuid.pc") added patches to util-linux and
util-linux-libs that require autoreconf, but forgot to add autoreconf
for util-linux-libs, which this new commit fixes.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit b45e479b96)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:04:04 +02:00
Bernd Kuhls
22803c9d61 package/kodi: fix wayland build
Fixes wayland-related build error:
make[4]: *** No rule to make target '/usr/share/waylandpp/protocols/presentation-time.xml',
 needed by 'wayland-extra-protocols.hpp'.  Stop.

by adding a configure parameter pointing to STAGING_DIR.

The build error was not recorded by the autobuilders and can be
reproduced by this defconfig:

BR2_x86_64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_PER_PACKAGE_DIRECTORIES=y
BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
BR2_PACKAGE_KODI=y
BR2_PACKAGE_MESA3D=y
BR2_PACKAGE_MESA3D_GALLIUM_DRIVER_SOFTPIPE=y
BR2_PACKAGE_MESA3D_OPENGL_EGL=y
BR2_PACKAGE_MESA3D_OPENGL_ES=y
BR2_PACKAGE_PYTHON3=y
BR2_PACKAGE_PYTHON3_PY_ONLY=y
BR2_PACKAGE_WAYLAND=y

LibreELEC added this configure parameter seven years ago:
d19ab98bf3

so a backport to LTS branches should be considered.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 1fed1a6c75)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:03:46 +02:00
Bernd Kuhls
d874ecf8d0 package/util-linux: optionally add libpthread to uuid.pc
Buildroot commit 31af509b4f bumped
util-linux from version 2.40.2 to 2.41.1.

Upstream release 2.40.3 contains
e143539d30
which unconditionally adds -lpthread to uuid.pc causing build errors for
other packages using non-threaded toolchains like erofs-utils.

Fixes:
https://autobuild.buildroot.net/results/582/5827995db2a805e0c8a04fde8498eff6f28aa6d8/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit dd4161c39d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:03:03 +02:00
Bernd Kuhls
8dcd9797d2 package/jemalloc: needs MMU
src/pages.c:79:33: error: 'MADV_DONTNEED' undeclared (first use in this
 function)
   79 |         if (madvise(addr, size, MADV_DONTNEED) == 0) {

The oldest build error found in the autobuilder logs dates back to 2024:
https://autobuild.buildroot.net/results/adf/adf52f767c92ab1db7b817094a3929f3cf918e82/
so a backport to LTS branches should be considered.

Fixes:
https://autobuild.buildroot.net/results/d6a/d6a9f7ff9d29eee9d9280364f872ffaa1544f192/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 31e1088bba)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:02:49 +02:00
Bernd Kuhls
4539cb556b package/jemalloc: fix build on m68k/uClibc
include/jemalloc/internal/jemalloc_internal_inlines_a.h:16:32: error:
 implicit declaration of function 'sched_getcpu'; did you mean
 'SYS_getcpu'? [-Wimplicit-function-declaration]
   16 |         return (malloc_cpuid_t)sched_getcpu();

Added -D_GNU_SOURCE to CFLAGS because

  extern int sched_getcpu

is wrapped with __USE_GNU:
https://github.com/wbx-github/uclibc-ng/blob/v1.0.57/libc/sysdeps/linux/common/bits/sched.h#L80C1-L80C17

Fixes:
https://autobuild.buildroot.net/results/57c/57c68aad9abcce7621fbff52081da041485e8830/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 6b15fa64e6)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:02:28 +02:00
Bernd Kuhls
df47e4fec2 package/gdb: link with libatomic if needed
Fixes:
gdb-14.2: https://autobuild.buildroot.net/results/32f/32f5715285ca46370df2ab35c38d16dbdbde5d21/
gdb-15.2: https://autobuild.buildroot.net/results/386/38645389cc5fdb1d5fdfa5d6f6eef417a975ea41/

Support for gdb 14.x was added to buildroot with commit
a9a56ab6fd so a backport to LTS branches
should be considered.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 10d428f9c3)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:02:11 +02:00
Bernd Kuhls
516e0521e8 package/libdill: autoreconf needs host-pkgconf
Buildroot commit 106e2b448c bumped libdill
to include an upstream commit:
b3b81d2c7b
which added PKG_CHECK_MODULES to configure.ac causing an error during
autoreconf when openssl, with host-pkgconf added as optional dependency,
is not selected:

configure.ac:119: error: possibly undefined macro: AC_CHECK_LIB
      If this token and others are legitimate, please use m4_pattern_allow.
      See the Autoconf documentation.
configure.ac:127: error: possibly undefined macro: AC_MSG_ERROR

Fixes:
https://autobuild.buildroot.net/results/05c/05c6a3f5a9290f1e5e4f62fea13a0f4cb1278c04/

The first build error of this kind occurred on 2022-08-21:
https://autobuild.buildroot.net/results/a29/a294492db81b6fd105dac88d8f5c8bc1a222bb8e/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 5b9a32dc72)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:01:36 +02:00
Peter Korsgaard
cf2b6482ed package/icu: drop outdated comment about git tags format
Commit 5bf0db998b ("package/icu: bump version to 78.1") dropped the
dash-to-dot conversion logic as upstream now uses dots in the tags names
(E.G.  release-78.1), but forgot to drop the comment explaining why we were
doing the conversion - So drop the now outdated comment.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit d22ff1628f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 12:00:02 +02:00
Waldemar Brodkorb
bbca2bf4b0 package/readline: fix a segfault in connmanctl
Reported via IRC in #buildroot connmanctl segfaults randomly
on startup and keyboard input is not echoed back.

Could be reproduced with Raspberry PI4 (32 Bit) defconfig and glibc
based userland.

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit c44987411c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 11:56:51 +02:00
Thomas Perale
2a9e6de11c support/dependencies/check-host-cmake.sh: verify version argument
When running 'make show-info-all' without a '.config', it is possible to
trigger this script without passing a version number.

The 'show-info-all' target is special because it forces the reading of
all packages without requiring a .config, so BR2_HOST_CMAKE_AT_LEAST is
unset and the script is called as:
  check-host-cmake.sh cmake cmake3

Without validation, the integer comparisons below would produce errors
like:
  check-host-cmake.sh: line 37: [: cmake: integer expected

It's possible to trigger this by adding the following file somewhere in
you path:

cat >/bin/cmake3 <<EOF
echo "cmake version 4.3.3 CMake suite maintained and supported by Kitware (kitware.com/cmake)."
EOF
make show-info-all

The same issue can also occur with pkg-stats.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit e7533662a4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 11:55:55 +02:00
Thomas Perale
ba410d9a15 Makefile: add 'show-info-all'
The maintenance and testing workflow sometimes requires to output a
list of every existing package on Buildroot:

- Generating an SBOM of the whole Buildroot tree, e.g. `for
  security.buildroot.org
- List every source for every package, e.g. for sources.buildroot.net

The previous solution relied on `make allyesconfig` but always ran into
conflicts that needed manual resolution. Also some packages would not be
present because they are architecture dependent.

To avoid having to manually modify the 'show-info' command this commit
adds the 'show-info-all' command. It accesses the PACKAGES_ALL variable
with all the packages present in Buildroot independently of the
architecture or any config entries.

It forces the `BR2_HAVE_DOT_CONFIG` variable to be set to force the
reading of the package mk files.

It is also added to noconfig_targets, to avoid the .config influencing
the output of show-info-all.

Note that this is not yet a complete solution - it doesn't take into
account the multiple versions that are possible for some packages like
GCC. Also for e.g. linux or uboot the version is empty and the URL is
invalid.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
[Arnout: refactor with existing show-info]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 723b321bb0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 11:54:04 +02:00
Thomas Perale
4039ed4771 package/gstreamer1: update CPE vendor
The CPE "cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*" is valid for
this package.

The previous vendor `gstreamer_project` has no CVE assigned to it except
"gstreamer_project:gst-rtsp-server" which target another package.

See the CVEs [1][2] ...

[1] https://nvd.nist.gov/vuln/detail/CVE-2026-3085
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-3086

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 4a5b7d733c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 11:53:56 +02:00
Thomas Perale
475048387b package/icu: update CPE vendor
The CPE "cpe:2.3:a:unicode:international_components_for_unicode:*:*:*:*:*:*:*:*"
is valid for this package.

Also remove the no longer needed "ICU_CPE_ID_VERSION" subst since [1].

The previous CPE hasn't been used since 2020. While the new one got two
CVE assigned since 2020.

[1] 5bf0db998b package/icu: bump version to 78.1
[2] https://nvd.nist.gov/vuln/detail/CVE-2025-5222
[3] https://nvd.nist.gov/vuln/detail/CVE-2020-21913

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 4893eeefde)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 11:53:48 +02:00
Thomas Perale
c4a08102a4 package/libgit2: add CPE vendor
The CPE "cpe:2.3:a:libgit2:libgit2:*:*:*:*:*:*:*:*" is valid for this
package.

The previous CPE hasn't been used since 2016 while the new one has 10
new CVEs assigned to it.

See the GHSA [1] and the associated CVE [2].

[1] https://github.com/libgit2/libgit2/security/advisories/GHSA-j2v7-4f6v-gpg8
[2] https://nvd.nist.gov/vuln/detail/cve-2024-24577

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit e166708e1e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 11:53:42 +02:00
Thomas Perale
ed8b0b51c8 package/cups-filter: update CPE vendor
The CPE "cpe:2.3:a:openprinting:cups-filters:*:*:*:*:*:*:*:*" is valid
for this package.

See the GHSA [1] and the associated CVE [2].

[1] https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-893j-2wr2-wrh9
[2] https://nvd.nist.gov/vuln/detail/CVE-2025-64503

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 2c3bc6609b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 11:53:34 +02:00
Thomas Perale
4fdde850df package/hiredis: add CPE vendor
The CPE "cpe:2.3:a:redis:hiredis:*:*:*:*:*:*:*:*" is valid for this
package.

See the GHSA [1] and the associated CVE [2].

[1] https://github.com/redis/hiredis/security/advisories/GHSA-hfm9-39pp-55p2
[2] https://nvd.nist.gov/vuln/detail/CVE-2021-32765

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 88b575a920)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 11:52:31 +02:00
Thomas Perale
6aeadf3b77 package/jq: add CPE vendor
The CPE "cpe:2.3:a:jqlang:jq:*:*:*:*:*:*:*:*" is valid for this package.

See the GHSA [1] and the associated CVE [2].

[1] https://github.com/jqlang/jq/security/advisories/GHSA-rmpv-jgvr-wpr9
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-44777

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 3dad008858)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 11:52:21 +02:00
Alexis Lothoré
746b5ecf8d package/openscap: add dependency on NPTL threads
Openscap code is calling NPTL functions such as pthread_barrier_wait,
which are not provided by pthreads.

Make the requirement on NPTL threads explicit by adding the
corresponding  dependency in openscap Config.in.

Fixes: https://autobuild.buildroot.org/results/2d9475b7cd2d413c99d6233ebb213bc932f1e398/
Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit d9b9ae8b4e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 11:49:26 +02:00
Bernd Kuhls
b660ad1dce package/libdrm: link with libatomic if needed
Fixes:
https://autobuild.buildroot.net/results/ea0/ea085cdea8458768c5f0ddb16f618a572406e65a/

The oldest build error dates back to May 2024
https://autobuild.buildroot.net/results/8ff/8ff4e16bb79294c5e289989855b5875851342909/
so a backport to LTS branches should be considered.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 6fec4282a0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 11:49:07 +02:00
Shubham Chakraborty
878a2578b3 DEVELOPERS: add entry for Shubham Chakraborty (xterm)
Signed-off-by: Shubham Chakraborty <chakrabortyshubham66@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 196070ae5e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 11:49:00 +02:00
Shubham Chakraborty
94c6d957e3 DEVELOPERS: add entry for Shubham Chakraborty (unrar)
Signed-off-by: Shubham Chakraborty <chakrabortyshubham66@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 232f8b5ca7)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 11:48:52 +02:00
Peter Korsgaard
ae710096ba package/podman: ignore CVE-2026-33414
As stated in the advisory:

The affected code is only used on Windows, all other operating systems are
not affected by this and can thus ignore the CVE patch.

https://github.com/containers/podman/security/advisories/GHSA-hc8w-h2mf-hp59

So mark it as ignored.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit b3c1619c56)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 11:46:45 +02:00
Titouan Christophe
4e36050660 utils/bump-stable-kernel-versions: update for split hash file
Since Buildroot commit 0e3ddc9dc8,
linux hash files are split between pre- and post-6.17.

Since that commit, the script that automatically updates kernel
versions in Buildroot was broken, as it assumed only a single linux
hash file at a static location. Update the script to find all relevant
files, even if a new split occurs in the future.

In addition, this patch carries additional minor changes:
- Fix some minor shellcheck issues found with a newer shellcheck version
  than in the container (quoting, test -a -> -e)
- Move from wget to curl, as I had some issue on my home connection
  with the former (possibly ipv6 related or something)

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit da01b7271a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 11:46:34 +02:00
Marcus Hoffmann
60509603b8 DEVELOPERS: drop John Faith, email bounces
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 758e5cdbdd)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 11:46:26 +02:00
Marcus Hoffmann
795c6380e3 DEVELOPERS: drop Mauro Condarelli, email bounces
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit fdd94cac1b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 11:46:18 +02:00
Peter Korsgaard
5096c7df41 support/dependencies/dependencies.sh: reject buggy uutils install
uutils install 0.8.0 as used in Ubuntu 26.04 has a bug in the install
applet, breaking a number of packages:

https://github.com/uutils/coreutils/pull/11505
https://bugs.launchpad.net/ubuntu/+source/rust-coreutils/+bug/2151454

The fix has been merged upstream but not yet released or packaged in Ubuntu,
so detect and reject the buggy version and explain how to change to the
coreutils version. Once fixed the version output will hopefully change.

For simplicity, only check for the exact 0.8.0 version string. Hopefully
when it is fixed in Ubuntu, they also update the version string. Note
that earlier versions of uutils have the same issue of course, but those
versions were never the default "install" on Ubuntu (or anywhere else).

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 64cb69f155)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 11:46:01 +02:00
Quentin Schulz
2ebef53381 Revert "linux: disable -Werror"
This reverts commit 6b56e0b4f0.

commit 6b56e0b4f0 ("linux: disable -Werror") said we needed to disable
CONFIG_WERROR in the kernel because it failed to build the esp-hosted
kernel module. This was very much the hammer approach because a) it'd be
better to fix the warnings in the kernel module or b) disable the
kernel's CONFIG_WERROR *only* if esp-hosted is to be built, via the
ESP_HOSTED_LINUX_CONFIG_FIXUPS variable in
package/esp-hosted/esp-hosted.mk.

This is a simple revert without making any change to any kernel module
(including esp-hosted) because all upstream Buildroot defconfigs with a
kernel module enabled build fine today (albeit with warnings). The two
defconfigs that were pointed at by the now-reverted commit all have been
(updated for and) run on master without failing the build.

Suggested-by: Arnout Vandecappelle <arnout@rnout.be>
Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit a966f5cde5)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 11:45:23 +02:00
Bernd Kuhls
6dfd71a1b9 package/exim: security bump version to 4.99.4
https://lists.exim.org/lurker/message/20260529.143857.4c75d7df.en.html
https://www.exim.org/static/doc/security/EXIM-Security-2026-05-19.1/EXIM-Security-2026-05-19.1.txt

Fixes CVE-2026-48840.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 727c2981cb)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 11:44:26 +02:00
Bernd Kuhls
0c9be0dd19 package/exim: security bump version to 4.99.3
https://seclists.org/oss-sec/2026/q2/491
https://exim.org/static/doc/security/EXIM-Security-2026-05-01.1/EXIM-Security-2026-05-01.1.txt

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 7774858c11)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 11:44:20 +02:00
Bernd Kuhls
34da6b3662 package/libmicrohttpd: needs host-pkgconf
Buildroot commit 712121326f bumped the
package to 1.0.5 which includes upstream commit
a1f9374226
that breaks the build if pkgconf was not found:
https://github.com/Karlson2k/libmicrohttpd/blame/master/m4/pkg.m4#L84

Fixes:
https://autobuild.buildroot.net/results/e3e/e3e25753c670b5d86d042d850582e2e1e0eedca5/
https://gitlab.com/buildroot.org/buildroot/-/jobs/14386351826

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 0ff8b74a0c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 11:43:08 +02:00
Bernd Kuhls
c5fbbc198c package/odhcp6c: fix build with gcc >= 14.x
Detected by Gitlab pipeline when testing the other build fixes in this
series. Autobuilders did not detect the problem due to the build error
with glibc 2.43.

https://gitlab.com/bkuhls/buildroot/-/jobs/14571737512

/builds/bkuhls/buildroot/br-test-pkg/bootlin-powerpc-e500mc-uclibc/build/odhcp6c-f19dd37fb467c9cf10cad57aefa0d048312d7dfd/src/dhcpv6.c:1395:58:
 error: comparison of integer expressions of different signedness:
 ‘uint32_t’ {aka ‘unsigned int’} and ‘int’ [-Werror=sign-compare]
 1395 | if (ia_hdr->iaid != htonl(ifindex) && otype == DHCPV6_OPT_IA_NA)

https://gitlab.com/bkuhls/buildroot/-/jobs/14571737510

/builds/bkuhls/buildroot/br-test-pkg/bootlin-openrisc-uclibc/build/odhcp6c-f19dd37fb467c9cf10cad57aefa0d048312d7dfd/src/dhcpv6.c:1395:58:
 error: comparison of integer expressions of different signedness:
 ‘uint32_t’ {aka ‘unsigned int’} and ‘int’ [-Werror=sign-compare]

https://gitlab.com/bkuhls/buildroot/-/jobs/14571737505

/builds/bkuhls/buildroot/br-test-pkg/bootlin-m68k-68040-uclibc/build/odhcp6c-f19dd37fb467c9cf10cad57aefa0d048312d7dfd/src/dhcpv6.c:1395:58:
 error: comparison of integer expressions of different signedness:
 ‘uint32_t’ {aka ‘unsigned int’} and ‘int’ [-Werror=sign-compare]

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 17b434cf07)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 11:41:28 +02:00
Bernd Kuhls
baf285e1ec package/odhcp6c: needs gcc >= 10
Fixes build errors seen with Gitlab pipeline and this defconfig:
support/config-fragments/autobuild/bootlin-aarch64-glibc-old.config

https://gitlab.com/bkuhls/buildroot/-/jobs/14570080455

aarch64-linux-gcc.br_real: error: unrecognized command line option
 ‘-Wimplicit-fallthrough=5’; did you mean ‘-Wno-fallthrough’?
aarch64-linux-gcc.br_real: error: unrecognized command line option
 ‘-Wshadow=local’; did you mean ‘-Wshadow-ivar’?

Removing all the unrecognized command line options from CMakeLists.txt
showed more build errors during compile:

output/build/odhcp6c-24485bb4b35ab84c17c2e87bd561d026d4c15c00/src/odhcp6c.h:47:46:
 error: expected ‘)’ before ‘__VA_OPT__’
 #define error(fmt, ...) __iflog(LOG_ERR, fmt __VA_OPT__(, ) __VA_ARGS__)

Another pipeline with gcc 9 showed other errors:
https://gitlab.com/bkuhls/buildroot/-/jobs/14570080479

/builds/bkuhls/buildroot/br-test-pkg/br-arm-basic/build/odhcp6c-24485bb4b35ab84c17c2e87bd561d026d4c15c00/src/dhcpv6.c:1126:4:
 error: a label can only be part of a statement and a declaration is not a statement
 1126 |    struct dhcpv6_auth *r = (void*)&odata[-DHCPV6_OPT_HDR_SIZE];

so we raise the minimum gcc version to 10.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit f8ea3ae2a5)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 11:38:40 +02:00
Francois Perrad
2afb974ea2 package/graphene: needs a toolchain with threads
Building without threads support fails:
/home/autobuild/autobuild/instance-9/output-1/host/aarch64-buildroot-linux-uclibc/sysroot/usr/include/features.h:220:5: warning: #warning requested reentrant code, but thread support was disabled [-Wcpp]

Added dependency to threads as suggested by upstream:
https://github.com/ebassi/graphene/pull/268#issuecomment-2283737538

Fixes:
http://autobuild.buildroot.org/results/9b3/9b357b1ef2eccd3110d0ecaaff1ae4883dff9280

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
[Bernd:
 - added comment to libgtk4
 - added upstream response to our bug report]
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 07f872bfe2)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 11:38:10 +02:00
Bernd Kuhls
06f68f39d1 package/vorbis-tools: Fix build with gcc 14.x
Buildroot commit ce5d173571 removed
0001-fix-build-with-gcc-14.patch which the version bump to 1.4.3.

The patch originally not only fixed share/utf8.c but also
ogginfo/codec_skeleton.c. Upstream only applied the fix for
ogginfo/codec_skeleton.c:
68c5a33685
so the build still fails:

utf8.c: In function 'convert_buffer':
utf8.c:271:9: error: implicit declaration of function 'charset_convert'
 [-Wimplicit-function-declaration]
  271 |   ret = charset_convert(fromcode, tocode, from, fromlen, to, tolen);

Added upstream commit to fix the problem.

Fixes:
https://autobuild.buildroot.net/results/135/13520e3cbf6b6d169985f4d1378c2a1baab852e0/

The build error can be reproduced by this minimal defconfig:
BR2_TOOLCHAIN_BUILDROOT_UCLIBC=y
BR2_PACKAGE_VORBIS_TOOLS=y

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 8b79a9fec5)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 11:37:15 +02:00
Bernd Kuhls
17ab58e658 package/ustream-ssl: needs OpenSSL ssl-trace
Buildroot commit e1050a3a50 bumped the
package which includes upstream commit
https://git.openwrt.org/?p=project/ustream-ssl.git;a=commit;h=956fba242ac0a4bcfe3db103d4d1f41545c924fb
that adds the usage of SSL_trace causing a build error when OpenSSL was
built without ssl-trace support:

/home/autobuild/autobuild/instance-10/output-1/build/ustream-ssl-5a81c108d20e24724ed847cc4be033f2a74e6635/ustream-openssl.c:
 In function '__ustream_ssl_set_debug':
/home/autobuild/autobuild/instance-10/output-1/build/ustream-ssl-5a81c108d20e24724ed847cc4be033f2a74e6635/ustream-openssl.c:490:44:
 error: 'SSL_trace' undeclared (first use in this function); did you mean 'SSL_write'?
  490 |         SSL_CTX_set_msg_callback(ctx->ssl, SSL_trace);

Fixes:
https://autobuild.buildroot.net/results/17c/17c88282c32f2edfa0991e0e10cb45013c947be9/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 88882b21f2)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 11:36:50 +02:00
Bernd Kuhls
46794e33bc package/gstreamer1/gst1-plugins-bad: disable qsv support
64ed6075b7
added support for the Intel Quick Sync Video Encoder with version 1.22.0
that was added to buildroot with commit
895840edd2.

On unsupported platform the build is broken:

In file included from ../sys/qsv/libmfx/api/vpl/mfxdispatcher.h:10,
                 from ../sys/qsv/libmfx/dispatcher/vpl/mfx_dispatcher_vpl_log.h:24,
                 from ../sys/qsv/libmfx/dispatcher/vpl/mfx_dispatcher_vpl_log.cpp:7:
../sys/qsv/libmfx/api/vpl/mfxdefs.h:75:6: error: #error Unknown packing
   75 |     #error Unknown packing

caused by
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/blob/1.24.13/subprojects/gst-plugins-bad/sys/qsv/libmfx/api/vpl/mfxdefs.h?ref_type=tags#L75

For now we disable qsv support to fix build errors on

arc: https://autobuild.buildroot.net/results/2d5/2d5666324db2fca7ab0419e28481829edca949b3/
m68k: https://autobuild.buildroot.net/results/53b/53ba2e9d09c25fe85e96b6e1fc9adbfcf5a637b2/
microblazeel: https://autobuild.buildroot.net/results/bc2/bc2b2324f385d2cafdae71ac19804f27f7a7414b/
or1k: https://autobuild.buildroot.net/results/17e/17e3dac016a08da8db58d735d0f2d3acc259f81f/
sparc: https://autobuild.buildroot.net/results/f07/f07995804faa0be38bbba462c52be86c6c69822b/

Fixes:
https://autobuild.buildroot.net/results/bc2/bc2b2324f385d2cafdae71ac19804f27f7a7414b/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit d0cacc6acf)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 11:36:32 +02:00
Bernd Kuhls
cd1c5871d1 package/efl: re-add patches to fix drm-related build errors
Buildroot commit c7a1b73f17 removed
patches 0001-ecore_evas-engines-drm-meson.build-use-gl_deps-as-en.patch
and 0002-ecore_evas-engines-drm-meson.build-fix-gl_drm-includ.patch.

This defconfig

BR2_x86_64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
BR2_PACKAGE_EFL=y
BR2_PACKAGE_EFL_DRM=y
BR2_PACKAGE_MESA3D=y
BR2_PACKAGE_MESA3D_GALLIUM_DRIVER_SOFTPIPE=y
BR2_PACKAGE_MESA3D_OPENGL_GLX=y
BR2_PACKAGE_MESA3D_OPENGL_EGL=y
BR2_PACKAGE_MESA3D_OPENGL_ES=y
BR2_PACKAGE_XORG7=y
BR2_PACKAGE_LUAJIT=y

is broken now during configure stage

output/build/efl-1.28.1/src/modules/ecore_evas/engines/drm/meson.build:6:18:
 ERROR: Unknown variable "engine_gl_drm".

which is fixed by former patch 0001.

Later a build error occurs which is fixed by former patch 0002.

The error was not yet caught by the autobuilders.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 526b89cfd8)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 11:35:46 +02:00
Bernd Kuhls
6f6a77b233 package/gcc-bare-metal: fix build with host gcc 16
Fixes:
https://autobuild.buildroot.net/results/3ff/3ff8d6a1d7bbc02be9118afff243709de43d186d/

/home/autobuild/autobuild/instance-16/output-1/build/host-gcc-bare-metal-15.2.0/libcody/cody.hh:
 In member function 'void Cody::Detail::MessageBuffer::Space()':
/home/autobuild/autobuild/instance-16/output-1/build/host-gcc-bare-metal-15.2.0/libcody/cody.hh:113:24:
 error: no matching function for call to 'S2C(const char8_t [2])'
  113 |     Append (Detail::S2C(u8" "));
      |             ~~~~~~~~~~~^~~~~~~
  * there is 1 candidate
    * candidate 1: 'template<unsigned int I> constexpr char Cody::Detail::S2C(const char (&)[I])'
      /home/autobuild/autobuild/instance-16/output-1/build/host-gcc-bare-metal-15.2.0/libcody/cody.hh:51:16:
         51 | constexpr char S2C (char const (&s)[I])
            |                ^~~
      * template argument deduction/substitution failed:
        *   mismatched types 'const char' and 'const char8_t'

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 4234bc46d0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 11:17:42 +02:00
Thomas Perale
6681de3d35 package/pkg-generic.mk: replicate IGNORE_CVES to host packages
For host packages, this commit adds the same `ignore_cves` list as their
target counterpart and make it available from the `show-info` output.

When generating a CycloneDX SBOM with `make show-info-all |
utils/generate-cyclonedx` and running an analysis over it with
`support/script/cve-check`, multiple vulnerabilities
entries would be created with different analysis for packages that have
both a host and target variant that include IGNORE_CVES entries.

This is the case for the grub2 package that include ignored
vulnerabilities that patch both the target and host package but aren't
declared as ignored for the host package. This resulted in
vulnerabilities marked as 'exploitable' for the host variant while it
is patched.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 7a5817137b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 11:04:21 +02:00
Thomas Perale
8b76c78151 support/scripts/cve-check: fix vulnerabilities with different analysis
Before this commit, only one entry per vulnerability ID was added to the
output. In CycloneDX, if you need to provide different analyses for
different affected components with the same vulnerability ID, you must
create multiple entries with the same ID.

When running `cve-check` with the `--include-resolved` argument, the
analysis of some vulnerabilities would get overwritten, which led to
undefined analysis results.

This is especially true when running the analysis on multiple components
with the same name but different versions. For instance, if the input
SBOM includes both the `gnupg` and `gnupg2` packages, CVE-2025-68973
could be included. This CVE might be exploitable for the `gnupg` package
but resolved for `gnupg2`. Therefore, a single analysis entry cannot
cover both cases.

This commit fixes the logic for adding vulnerabilities to the output
SBOM. A vulnerability is now added as a new entry if:

1. A vulnerability with the same ID doesn't exist yet.
2. The affect of the new vulnerability is not the same as the one
   already present.

For the CVE-2025-68973 example this would result in the following
output:

```json
[
    {
        "id": "CVE-2025-68973",
        "analysis": {
            "state": "exploitable"
        }
        "affects": [
            {"ref": "gnupg"}
        ]
    },
    {
        "id": "CVE-2025-68973",
        "analysis": {
            "state": "resolved"
        }
        "affects": [
            {"ref": "gnupg2"}
        ]
    }
]
```

45 vulnerabilities were concerned by this bug over the Buildroot tree.

Co-Authored-By: Tim Soubry <tim.soubry@mind.be>
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit d4ff747a2b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 11:04:12 +02:00
Thomas Perale
5ecf3744f3 support/scripts/cve-check: remove 'bom-ref' for vulnerabilities
The 'bom-ref' are optional and since we don't reference the
vulnerabilities from anywhere else in the SBOM they are not necessary in
this case.

In the following commit, cve-check will potentially emit multiple
vulnerabilities that have the same id. So using the vulnerability id
as 'bom-ref' won't be correct as the 'bom-ref' needs to be unique
unlike the id property.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit af55c1a39b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 11:04:04 +02:00
Thomas Perale
ed86091d62 support/scripts/cve-check: add indication how to run
Always run this script from the output of 'generate-cyclonedx'. Do not re-run
this script over an already analysed SBOM.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 646356162b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 11:03:55 +02:00
Thomas Perale
df418f0675 support/scripts/cve-check: fix vulnerability timestamp to RFC 3339
Normalize vulnerability timestamps to RFC 3339 format with explicit UTC
timezone suffix for CycloneDX 1.6 compliance.
This fixes validation errors in sbom-utility and makes the generated
SBOM with vulnerabilities compatible with DependencyTrack VEX parsers.

The NVD JSON data feeds provide timestamps in ISO 8601 format without timezone
information (e.g., "1999-01-01T05:00:00.000"), but CycloneDX 1.6 requires
RFC 3339 format with explicit timezone designation (e.g.,
"1999-01-01T05:00:00.000Z").

Add nvd_datetime_to_rfc3339() helper function to convert timestamps before
serialization.

Validation results:

Before fix:
  $ sbom-utility validate -i cve/cve_report_current.json
  [INFO] BOM valid against JSON schema: 'false'
  [INFO] (234) schema errors detected.

  Error example:
  {
    "type": "format",
    "field": "vulnerabilities.0.updated",
    "context": "(root).vulnerabilities.0.updated",
    "description": "Does not match format 'date-time'",
    "value": "2025-04-03T01:03:51.193"
  }

After fix:
  $ sbom-utility validate -i cve/cve_report_update.json
  [INFO] BOM valid against JSON schema: 'true'

Tested-with: sbom-utility v0.18.1
Co-authored-by: Fabien Lehoussel <fabien.lehoussel@smile.fr>
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit e46783d3a0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 11:03:26 +02:00
Bernd Kuhls
ee0ee0b33e package/vlc: rebase patch set
Added Upstream: tags when possible.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 33c26bb898)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 11:03:09 +02:00
Bernd Kuhls
bbb0815f11 package/vlc: update freerdp2 patch
Replace Gentoo patch from 2018 with rebased version of an upstream
commit from 2022 which also fixes build errors introduced by gcc 14.x:

access/rdp.c: In function 'postConnectHandler':
access/rdp.c:238:39: error: assignment to 'pDesktopResize' {aka 'int
 (*)(struct rdp_context *)'} from incompatible pointer type 'void
 (*)(rdpContext *)' {aka 'void (*)(struct rdp_context *)'}
 [-Wincompatible-pointer-types]
  238 |     p_instance->update->DesktopResize = desktopResizeHandler;
      |                                       ^

No autobuilder error was recorded, the build error can be reproduced
with this defconfig:

BR2_x86_64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_PACKAGE_VLC=y
BR2_PACKAGE_FREERDP=y

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 9097605d29)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 11:03:00 +02:00
Bernd Kuhls
8bee785fc1 package/vlc: replace wayland-scanner patch with upstream commit
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit a659fa3bb5)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 11:02:34 +02:00
Devreese Jorik
bcee92838f support/kconfig: fix compiler warnings
Commit 324612d68e fixed several compiler warnings,
but actually introduced a new one by increasing the buffer size in confdata.c that gets passed
along to file_write_dep in util.c, because buf2's size wasn't increased along with it.

./util.c: In function ‘file_write_dep’:
./util.c:86:26: warning: ‘%s’ directive writing 10 or more bytes into a region of size between 1 and 4097 [-Wformat-overflow=]
   86 |         sprintf(buf2, "%s%s", dir, name);
      |                          ^~
./util.c:86:9: note: ‘sprintf’ output 11 or more bytes (assuming 4107) into a destination of size 4097
   86 |         sprintf(buf2, "%s%s", dir, name);
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Fix this by increasing the size of buf2 to match the passed buffer size.

Signed-off-by: Devreese Jorik <jorik.devreese@barco.com>
Signed-off-by: Thomas Devoogdt <thomas.devoogdt@barco.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 1f5095c1d3)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 11:01:19 +02:00
Raphael Pavlidis
8fec33c70d package/xwayland: bump to version 24.1.11
Fixes a number of regressions found in 24.1.10.

Changelog:
https://lists.x.org/archives/xorg-announce/2026-April/003697.html

Signed-off-by: Raphael Pavlidis <raphael.pavlidis@gmail.com>
[Peter: mention regression fixes]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 94d6d266f4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 10:54:50 +02:00
Thomas Perale
be577a367a package/libmad: add patch for CVE-2017-837{2, 3, 4}
The commit [1] introduced fixes for the following CVEs:

- CVE-2017-8372: The mad_layer_III function in layer3.c in Underbit MAD
  libmad 0.15.1b, if NDEBUG is omitted, allows remote attackers to cause
  a denial of service (assertion failure and application exit) via a
  crafted audio file.
- CVE-2017-8373: The mad_layer_III function in layer3.c in Underbit MAD
  libmad 0.15.1b allows remote attackers to cause a denial of service
  (heap-based buffer overflow and application crash) or possibly have
  unspecified other impact via a crafted audio file.
- CVE-2017-8374: The mad_bit_skip function in bit.c in Underbit MAD
  libmad 0.15.1b allows remote attackers to cause a denial of service
  (heap-based buffer over-read and application crash) via a crafted
  audio file.

In commit [2], the patches ended up not being applied anymore because
the APPLY_PATCHES step was called before the patch content exists.

This commit import the fixes in Buildroot.

[1] 858df3643f package/libmad: switch to debian to fix CVEs
[2] b21184a877 package/libmad: update the patches to be applied with fuzz 0

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 9c9c531d0b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 10:54:28 +02:00
Thomas Perale
89d3ff3f50 package/libmad: remove Debian patches
In Buildroot there are multiple way to apply patches on a package [1]

- Adding `.patch` file in the package directory.
- Define `<pkg>_PATCH` variable with the location of the patch tar.gz.
    It used to download Debian patches tarball.
- Implement custom patching logic with `PRE`/`POST` patches hooks.

The libmad package is downloading a diff file from the Debian
mirror with the `<pkg>_PATCH` method [2] and then apply that diff to
create a directory containing patches. The patches are then applied in
the `PRE_PATCH_HOOK`.

The Debian patches were integrated in commit [4], in commit [5] the
application of the patches was moved to the PRE_PATCH_HOOK.
The problem is that in the PRE_PATCH step the `_PATCH` downloaded from
Debian don't exist yet and end up not being applied at all.

Since this is not used, remove the Debian patches.

[1] https://buildroot.org/downloads/manual/manual.html#patch-policy
[2] http://snapshot.debian.org/archive/debian/20190310T213528Z/pool/main/libm/libmad/libmad_0.15.1b-10.diff.gz
[3] 1167d0ff3d docs/manual: mention CVE trailer
[4] 858df3643f package/libmad: switch to debian to fix CVEs
[5] b21184a877 package/libmad: update the patches to be applied with fuzz 0

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 103f84b30f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 10:54:12 +02:00
Thomas Perale
d310899839 package/heirloom-mailx: import patches from Debian
In Buildroot there are multiple way to apply patches on a package [1]

- Adding `.patch` file in the package directory.
- Define `<pkg>_PATCH` variable with the location of the patch tar.gz.
  It used to download Debian patches tarball.
- Implement custom patching logic with `PRE`/`POST` patches hooks.

To make the CycloneDX SBOM generation not dependant on downloading the
packages, the two last options have the downside of not appearing on the
generated SBOM.

The heirloom-mailx package is downloading a tarball from the Debian
mirror with the `<pkg>_PATCH` method [2].

To improve the tracking of the patched vulnerabilities for the
heirloom-mailx package this commit import the patches previously
downloaded with the `_PATCH` variable in the Buildroot tree. This allows
to add the `CVE:` trailer [3] on the patches that fix vulnerabilities to
better track which patch is fixing the vulnerability.

[1] https://buildroot.org/downloads/manual/manual.html#patch-policy
[2] http://snapshot.debian.org/archive/debian/20150815T155609Z/pool/main/h/heirloom-mailx/heirloom-mailx_12.5-5.debian.tar.xz
[3] 1167d0ff3d docs/manual: mention CVE trailer

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit c9659fd9e8)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 10:54:02 +02:00
Thomas Perale
76db7e8a10 package/unzip: import patches from Debian
In Buildroot there are multiple way to apply patches on a package [1]

- Adding `.patch` file in the package directory.
- Define `<pkg>_PATCH` variable with the location of the patch tar.gz.
  It used to download Debian patches tarball.
- Implement custom patching logic with `PRE`/`POST` patches hooks.

To make the CycloneDX SBOM generation not dependant on downloading the
packages, the two last options have the downside of not appearing on the
generated SBOM.

The unzip package is downloading a tarball from the Debian mirror with
the `<pkg>_PATCH` method [2].

To improve the tracking of the patched vulnerabilities for the unzip
package this commit import the patches previously downloaded with the
`_PATCH` variable in the Buildroot tree.
This allows to add the `CVE:` trailer [3] on the patches that fix
vulnerabilities to better track which patch is fixing the vulnerability.

[1] https://buildroot.org/downloads/manual/manual.html#patch-policy
[2] https://snapshot.debian.org/archive/debian/20250311T215724Z/pool/main/u/unzip/unzip_6.0-29.debian.tar.xz
[3] 1167d0ff3d docs/manual: mention CVE trailer

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit fb8958e3dc)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 10:53:45 +02:00
Waldemar Brodkorb
336e7a3ef1 package/asterisk: security bump to 22.9.0
See here for a changelog:
https://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-22-current.html

Pjsip was updated to 2.16.

Fixes some security issues in pjsip:

Author: Mike Bradeen Date: 2026-03-23
Address the following pjproject security vulnerabilities

GHSA-j29p-pvh2-pvqp - Buffer overflow in ICE with long username
GHSA-8fj4-fv9f-hjpc - Heap use-after-free in PJSIP presense subscription termination header
GHSA-g88q-c2hm-q7p7 - ICE session use-after-free race conditions
GHSA-x5pq-qrp4-fmrj - Out-of-bounds read in SIP multipart parsing

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 6add6e3cd8)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 10:45:00 +02:00
Peter Korsgaard
974176d512 package/radvd: security bump to version 2.21
Fixes the following vulnerability:

CVE-2026-48715: Stack Buffer Overflow in radvdump Route Information Option
Parser

https://github.com/radvd-project/radvd/security/advisories/GHSA-52px-gh9p-m379

Release notes:
https://github.com/radvd-project/radvd/releases/tag/v2.21

The release is now done on github, and a .tar.xz version is available so use
that. Notice that we cannot use the github macro.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f560174011)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 10:31:54 +02:00
Bernd Kuhls
1c16c1ed7e package/libde265: security bump version to 1.1.0
https://github.com/strukturag/libde265/releases/tag/v1.1.0

"Security fixes

- CVE TBD (GHSA-g2rg-wj66-w594) - Out-of-bounds write in
 process_reference_picture_set via predicted short-term RPS
- CVE TBD (GHSA-vv8h-932h-7r86) - Heap buffer overflow in
 de265_image_get_buffer via SPS dimension integer overflow
- CVE TBD (GHSA-g5hj-rf9f-7vxm) - Unbounded memory accumulation via
 orphaned slice headers in read_slice_NAL
- (GHSA-x27c-jp65-g395) - Quadratic CPU consumption in NAL parser
 (remove_stuffing_bytes, resize)

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit b280053180)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 10:30:58 +02:00
Bernd Kuhls
b362fa37e3 package/libde265: disable neon support for armv7m
Buildroot commit d4b8a42fb2 bumped the
package from 1.0.16 to 1.0.18.
Upstream added optional neon support in version 1.0.17:
f22cf00a86

The configure check detects neon support:

-- Performing Test HAVE_NEON
-- Performing Test HAVE_NEON - Success

but causes a build error at linking stage:

[100%] Linking CXX executable dec265
/builds/bkuhls/buildroot/br-test-pkg/bootlin-armv7m-uclibc/host/opt/ext-toolchain/arm-buildroot-uclinux-uclibcgnueabi/bin/ld.real:
 error: ../libde265/libde265.a(hevcdsp_qpel_neon.S.o):
 conflicting architecture profiles A/M

so we add a configure option to disable neon support.

The build error was not yet detected by the autobuilders but can be
reproduced using this defconfig:

BR2_arm=y
BR2_cortex_m4=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_ARMV7M_UCLIBC_STABLE=y
BR2_PACKAGE_LIBDE265=y

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit f51769b7e9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 10:30:21 +02:00
Bernd Kuhls
3b435a1bab package/libde265: link with libatomic if needed
Buildroot commit d4b8a42fb2 bumped the
package to version 1.0.18 which introduced build errors on sparc:

/home/autobuild/autobuild/instance-21/output-1/host/lib/gcc/sparc-buildroot-linux-uclibc/15.2.0/../../../../sparc-buildroot-linux-uclibc/bin/ld:
 ../libde265/libde265.so.0.1.12: undefined reference to
 `__atomic_fetch_add_4'

Fixes:
https://autobuild.buildroot.net/results/605/605dc19e86f113662cc35fe055c64c52698d70b4/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 38358daba9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 10:28:56 +02:00
Bernd Kuhls
0c465e005f package/libheif: security bump version to 1.22.2
https://github.com/strukturag/libheif/releases/tag/v1.22.2
"Fixes missing heif_image_get_bayer_pattern_size() function."

https://github.com/strukturag/libheif/releases/tag/v1.22.1
"Security
- CVE TBD (GHSA-r7qj-cg5r-r6vf) - Wrapped icef compressed-unit range
 check causes out-of-bounds read in uncompressed HEIF decoder
 - (GHSA-5hqq-636x-r3cr) - Out-of-bounds write in inline mask region API
                           when source mask exceeds declared region"

Removed patch which is included in version 1.22.1.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 08f3757b0f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 10:23:23 +02:00
Peter Korsgaard
66066ece80 package/python-urllib3: security bump to version 2.7.0
Fixes the following security issues:

CVE-2026-44431: Sensitive headers forwarded across origins in proxied
low-level redirects

https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc

CVE-2026-44432: Decompression-bomb safeguards bypassed in parts of the
streaming API

https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j

For more details, see the release notes:
https://urllib3.readthedocs.io/en/stable/changelog.html#id1

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 8b606d9074)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 10:22:43 +02:00
Bernd Kuhls
7ce09a9a71 package/nginx: security bump version to 1.30.2
https://nginx.org/en/CHANGES-1.30

https://nginx.org/en/security_advisories.html

1.30.2: Fixes CVE-2026-9256
1.30.1: Fixes CVE-2026-42926 (only from 1.29.4), CVE-2026-42945,
CVE-2026-42946, CVE-2026-42934, CVE-2026-40460 & CVE-2026-40701.

Updated license hash due to copyright year bump:
7fa941a55e

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Peter: clarify CVE-2026-42926]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 0455e2571d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-04 10:21:47 +02:00
Titouan Christophe
3e66f293f3 package/samba4: security bump to v4.23.8
See the release notes:
- https://www.samba.org/samba/history/samba-4.23.7.html
- https://www.samba.org/samba/history/samba-4.23.8.html

This fixes the following vulnerabilities:
- CVE-2026-1933
- CVE-2026-2340
- CVE-2026-3012
- CVE-2026-3238
- CVE-2026-4408
- CVE-2026-4480

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
(cherry picked from commit 46a4dcd0e1)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-03 14:02:00 +02:00
Joseph Kogut
6775bfd749 package/wpewebkit: fix stale libepoxy dependency comments
wpewebkit depends directly on OpenGL ES and EGL support, but those
dependencies are not imposed by libepoxy itself. Update the inline
comments so they describe the actual dependency source before relaxing
libepoxy's package-level EGL/GL dependency.

Signed-off-by: Joseph Kogut <joseph.kogut@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit a4b761f395)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-29 16:45:10 +02:00
James Hilliard
815e765c1a package/python-aiodns: bump to version 4.0.0
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit b9c60c5675)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-29 10:27:12 +02:00
Titouan Christophe
d40bb72793 {linux, linux-headers}: bump 6.12.x, 6.6.x, 6.1.x, 5.15.x, 5.10.x, 6.18.x series
Update the latest kernel releases to:
 - 6.12.90 -> 6.12.91
 - 6.6.140 -> 6.6.141
 - 6.1.173 -> 6.1.174
 - 5.15.207 -> 5.15.208
 - 5.10.256 -> 5.10.257
 - 6.18.32 -> 6.18.33

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2026-05-29 10:27:10 +02:00
Bernd Kuhls
6c722cafd2 package/unbound: security bump version to 1.25.1
https://nlnetlabs.nl/projects/unbound/download/

Used new signing key to verify the source tarball:
https://nlnetlabs.nl/signing-keys/

Fixes CVE-2026-33278, CVE-2026-42944, CVE-2026-42959, CVE-2026-32792,
CVE-2026-40622, CVE-2026-41292, CVE-2026-42534, CVE-2026-42923,
CVE-2026-42960, CVE-2026-44390 and CVE-2026-44608.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 74aed5e861)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-29 10:27:08 +02:00
Bernd Kuhls
7b9cb42f23 package/mariadb: security bump version to 10.11.17
https://mariadb.com/docs/release-notes/community-server/10.11/10.11.17
https://mariadb.com/docs/release-notes/community-server/changelogs/10.11/10.11.17

Fixes CVE-2026-44168, CVE-2026-44169, CVE-2026-44170, CVE-2026-44171,
CVE-2026-44172 & CVE-2026-44173.

https://mariadb.com/docs/release-notes/community-server/10.11/10.11.16
https://mariadb.com/docs/release-notes/community-server/changelogs/10.11/10.11.16

Fixes CVE-2026-3494 & CVE-2026-34303.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 3ddacc46e4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-29 10:27:05 +02:00
Viacheslav Bocharov
d119b1f979 DEVELOPERS: update entry for Viacheslav Bocharov
- Update email address to v@baodeep.com.
- Take over maintainership of package/amlogic-boot-fip.

Signed-off-by: Viacheslav Bocharov <v@baodeep.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 9d4d79f9ae)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-29 10:27:03 +02:00
Bernd Kuhls
1981320594 package/kexec: fix powerpc build
Added two upstream commits to fix build errors on powerpc.

The build error also occurs with kexec 2.0.30 on the 2025.02.x branch
so a backport to LTS branches should be considered:
https://autobuild.buildroot.net/results/2ec/2ec0d85c658f8264fcc4eef2deb6c67671e3e7ae/

Fixes:
https://autobuild.buildroot.net/results/53b/53bafc454533aeafc21116a99d87391b3049e12a/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 8181bc6e06)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-29 10:27:01 +02:00
Bernd Kuhls
af42bd7679 package/putty: security bump version to 0.84
https://lists.tartarus.org/pipermail/putty-announce/2026/000042.html

Updated license hash due to copyright year bump in upstream commit
995b63a82bac4f6985958cb92943e807a9f35736. A link to this commit can not
be provided due to the shutdown of the upstream gitweb interface:
https://git.tartarus.org/?p=simon/putty.git

Switched URLs to https.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 7418ff1389)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-29 10:26:59 +02:00
Bernd Kuhls
979aa00de4 package/haveged: security bump version to 1.9.21
https://github.com/jirka-h/haveged/blob/v1.9.21/ChangeLog

Fixes CVE-2026-41054: https://seclists.org/oss-sec/2026/q2/575
"The bug was added in 1.9.3."

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit c9e36ce805)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-29 10:26:57 +02:00
Joseph Kogut
cc6ace8158 package/weston: add EGL dependency for XWayland
BR2_PACKAGE_WESTON_XWAYLAND currently depends on BR2_PACKAGE_LIBEPOXY,
which implicitly requires either libGL or libEGL. However, the XWayland
glamor support uses libepoxy with EGL, so express that dependency
directly. With only libGL and no libEGL, it fails to build. E.g.,

BR2_aarch64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_AARCH64_GLIBC_STABLE=y
BR2_PACKAGE_MESA3D=y
BR2_PACKAGE_MESA3D_GALLIUM_DRIVER_ETNAVIV=y
BR2_PACKAGE_MESA3D_OPENGL_GLX=y
BR2_PACKAGE_XORG7=y
BR2_PACKAGE_XWAYLAND=y
BR2_PACKAGE_LIBEPOXY=y

fails with:

In file included from ../glamor/glamor_priv.h:73,
from ../glamor/glamor_composite_glyphs.c:25:
../glamor/glamor_context.h:27:10: fatal error: epoxy/egl.h: No such file or directory
27 | #include <epoxy/egl.h>
   |          ^~~~~~~~~~~~~

Signed-off-by: Joseph Kogut <joseph.kogut@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 701f8bb31c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-29 10:26:55 +02:00
Bernd Kuhls
afcf84e5a8 package/memcached: security bump version to 1.6.42
https://github.com/memcached/memcached/wiki/ReleaseNotes1642

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit d08416a5a2)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-29 10:26:53 +02:00
Giulio Benetti
2896d8fcc4 package/bind: security bump to version 9.18.49
Release notes:
https://ftp.isc.org/isc/bind9/9.18.49/doc/arm/html/notes.html

Changelog:
https://ftp.isc.org/isc/bind9/9.18.49/doc/arm/html/changelog.html

Fixes CVE-2026-3592, CVE-2026-3039, CVE-2026-5946, CVE-2026-5950.

Fixes bugs:
GL #5804
https://gitlab.isc.org/isc-projects/bind9/-/issues/5804
GL #3589
https://gitlab.isc.org/isc-projects/bind9/-/issues/3589

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 5528e00b10)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-29 10:26:51 +02:00
Bernd Kuhls
f210a8ce1e package/rsync: security bump version to 3.4.3
https://download.samba.org/pub/rsync/NEWS#3.4.3

Fixes CVE-2026-29518, CVE-2026-43617, CVE-2026-43618, CVE-2026-43619,
CVE-2026-43620 & CVE-2026-45232.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 47b5cbb1ca)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-29 10:26:49 +02:00
Bernd Kuhls
55d58669b5 package/imagemagick: security bump version to 7.1.2-23
https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#712-23---2026-05-17

Fixes the following CVEs:
CVE-2026-42326, CVE-2026-45031, CVE-2026-45358, CVE-2026-45359,
CVE-2026-45624, CVE-2026-45664, CVE-2026-46520, CVE-2026-46521,
CVE-2026-46522, CVE-2026-46523, CVE-2026-46557 & CVE-2026-46559.
[copied list of CVEs from
 https://www.news.de/technik/859626214/imagemagick-gefaehrdet-it-sicherheitshinweis-vom-bsi-und-bug-report-bekannte-schwachstellen-und-sicherheitsluecken/1/]

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 4e14863c94)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-29 10:26:46 +02:00
Bernd Kuhls
ca9d847951 package/libde265: security bump version to 1.0.19
https://github.com/strukturag/libde265/releases/tag/v1.0.19

Fixes CVE-2026-45382 & CVE-2026-45383.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 0d3d25bcc9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-29 10:26:44 +02:00
Bernd Kuhls
d6ea7821f2 package/libheif: security bump version to 1.22.0
https://github.com/strukturag/libheif/releases/tag/v1.22.0

Fixes the following CVEs/advisories:

CVE-2026-32738 (GHSA-7f2h-cmpf-v9ww) : Heap OOB Read / SEGV Crash via Zero samples_per_chunk in stsc
CVE-2026-32739 (GHSA-j9g7-q9hv-gq8c) : Infinite Loop DoS in stts Sample Duration Lookup
CVE-2026-32740 (GHSA-frfr-f3vg-2g6j) : Heap-Buffer-Overflow Write in Grid Tile Chroma Compositing
CVE-2026-32741 (GHSA-j3w5-7whq-p37q) : heap buffer overflow in decode_mask_image()
CVE-2026-32814 (GHSA-4m8r-34pg-rvwc) : Uninitialized Heap Memory Information Leak via Failed Grid Tiles
CVE-2026-32882 (GHSA-hg7q-rjr2-8x46) : Heap Buffer OOB Read in overlay compositing due to wrong alpha stride
CVE-2026-41069 (GHSA-p82x-fpmv-576r) : Out-of-bounds vector access leading to invalid dereference
CVE-2026-41071 (GHSA-xj92-xjff-h8w3) : Heap buffer over-read in SampleAuxInfoReader via crafted HEIF sequence file with mismatched saiz sample count
CVE-2026-47178 (GHSA-5x55-x5pf-9c6g) : Heap Out Of Bounds Write in unci subsystem
CVE-2026-47247 (GHSA-2vh6-whr3-cmq3) : Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane Allocation
CVE-2026-47251 (GHSA-p6q9-fhf2-vj9v) : Incomplete fix for CVE-2026-3949: integer overflow bypass in vvdec_push_data2
CVE-2026-47254 (GHSA-wqjg-4x9g-6cvg) : Heap Buffer Overflow in Track::get_next_sample_raw_data() -- OOB Chunk Vector Access
CVE-2026-47709 (GHSA-4h72-vqgp-9376) : NULL pointer dereference in heif_image_handle_get_image_tiling for malformed unci image missing ispe
CVE-2026-47714 (GHSA-h4wm-6wwf-qvhx) : Integer overflow in inline mask size calculation causes undersized buffer allocation
CVE TBD (GHSA-6x5f-qchq-cxqv) : heap OOB read in ImageItem_Grid::decode_grid_tile via irot-induced tile-coordinate underflow
(GHSA-95jx-g5vf-cpp8) : Integer Overflow in SampleAuxInfoReader Offset Calculation
(GHSA-p4r6-6972-g26m) : Incorrect byte-count initialization in BitstreamRange constructor allows container-boundary check bypass
(GHSA-jh2w-m72q-q595) : Out-of-bounds read and assertion-based DoS in EXIF parsing (find_exif_tag / read32) with short EXIF TIFF payload
(GHSA-9h96-c44j-jpq9) : Heap buffer overflow via uint32_t stride overflow in image plane allocation

Added upstream commit to fix build error with imagemagick which would
be introduced by this bump.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 944f41e9e2)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-29 10:26:42 +02:00
Bernd Kuhls
73492e71da package/libheif: bump version to 1.21.2
https://github.com/strukturag/libheif/releases/tag/v1.21.2

Use sha256 tarball hash provided by upstream.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 4ed5af5288)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-29 10:26:40 +02:00
Andreas Mohr
b6169edea5 package/libargon2: fix pkgconfig version string
Current build generated pkgconfig/libargon2.pc has wrong version string.
    Version: ZERO

Signed-off-by: Andreas Mohr <and@gmx.li>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 1ef471a61d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-29 10:26:38 +02:00
Bernd Kuhls
347d2116fa package/gnupg2: security bump version to 2.5.20
https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000505.html
"This release adds two features to gpgsm and fixes a some minor security
 bugs."

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit b28aeeab1f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-29 10:26:36 +02:00
Bernd Kuhls
01a6c31a68 package/gnupg2: bump version to 2.5.19
https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000504.html

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 77aeabb8b5)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-29 10:26:34 +02:00
Julien Olivain
83b09ce2a3 package/gnupg2: bump to version 2.5.18
For release notes, see:
https://dev.gnupg.org/T7999

Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 2078ff1c32)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-29 10:26:32 +02:00
Julien Olivain
18dd343da4 package/tzdata: bump to 2026b
For release notes, see:
https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/VX2Z3CBO6KHTYZNBBKFFWM7ZCI6TVCXP/

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit b2e3521685)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-29 10:26:30 +02:00
Julien Olivain
5712f79b87 package/zic: bump to 2026b
For release notes, see:
https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/VX2Z3CBO6KHTYZNBBKFFWM7ZCI6TVCXP/

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 721a44f935)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-29 10:26:27 +02:00
Giulio Benetti
6728e1d284 package/zlib-ng: fix build failure for PowerPC soft-float
As suggested in this review[1], when building for PowerPC with soft-float
enabled, let's also disable both WITH_POWER8/9 that in order disables
all the possible PowerPC acceleration instructions.

Fixes:
https://autobuild.buildroot.org/results/a0fa5a175c546993d818371a0de93b2e9845a183/

[1]: https://github.com/zlib-ng/zlib-ng/pull/2151/changes#r2803264882

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit 668b47bdab)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-29 10:26:25 +02:00
Michael Nosthoff
3afe2535b9 package/supertux: fix build with gcc > 11
Fixes:
 "missing #include <memory>" when building with GCC > 11.

Signed-off-by: Michael Nosthoff <buildroot@heine.tech>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit 56ff67b50b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-29 10:26:23 +02:00
Bernd Kuhls
79acbb383d package/postgresql: security bump version to 18.4
https://www.postgresql.org/about/news/postgresql-184-1710-1614-1518-and-1423-released-3297/

Fixes CVE-2026-6472, CVE-2026-6473, CVE-2026-6474, CVE-2026-6475,
CVE-2026-6476, CVE-2026-6477, CVE-2026-6478, CVE-2026-6479,
CVE-2026-6575, CVE-2026-6637, CVE-2026-6638.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 9fb64dfc24)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-29 10:26:21 +02:00
Julien Olivain
2ebb05124c package/libabseil-cpp: add patch to fix build with gcc <= 12
libabseil-cpp headers can break some packages build, like protobuf,
when compiled with gcc 12. See [1] [2]. The issue has been reported
in protobuf upstream, in [3].

The issue is due to gcc <= 12 not supporting the mix of standard
C++ attributes with GNU attributes. See [4].

Gcc 12 has been removed from Buildroot internal toolchains in
commit [5], but gcc 12 can still be present in external toolchains
or on the host. This is currently the case of the Buildroot Docker
reference image, based on Debian 12 (Bookworm).

This commit fixes the issue by adding a package patch.

Fixes:
- [1] [2] and many more.

[1] https://gitlab.com/buildroot.org/buildroot/-/jobs/13904066346
[2] https://autobuild.buildroot.org/results/33f6cfd37cb48c15a53b3e7123d5ce8388a0f2ab
[3] https://github.com/protocolbuffers/protobuf/issues/26383
[4] https://gcc.gnu.org/PR69585
[5] 58cf7c51da
[6] https://github.com/abseil/abseil-cpp/pull/2044

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit 955fb2f7c4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-29 10:26:19 +02:00
Bernd Kuhls
843b2dffcb package/libks: select BR2_PACKAGE_LIBOPENSSL_ENGINES
libks makes use of ERR_* functions defined in openssl/err.h which are
included by openssl/engine.h resulting in a build failure when
!BR2_PACKAGE_LIBOPENSSL_ENGINES since commit
623d3bbe43:

/home/buildroot/instance-0/output-1/build/libks-2.0.5/src/ks_ssl.c:111:17:
 error: implicit declaration of function 'ERR_free_strings'; did you mean
 'ERR_load_EC_strings'? [-Wimplicit-function-declaration]
  111 |                 ERR_free_strings();

Fixes:
https://autobuild.buildroot.net/results/aac/aac25e5c584ede962cac95c353afd64bf720199c/

The oldest build error on the master branch dates back to Feb 2025:
https://autobuild.buildroot.net/results/83a/83a207bee796afbc619b62c5ecf89c662484170f/
so a backport to LTS branches should be considered.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit 40e9341b0b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-29 10:26:17 +02:00
Dario Binacchi
4de77652d6 package/libgphoto2: fix build with gcc >= 14
The commit adds an upstream patch to fix the following build failure:

jl2005c/jl2005bcd_decompress.c: In function 'jl2005bcd_decompress':
jl2005c/jl2005bcd_decompress.c:161:46: error: passing argument 3 of 'jpeg_mem_dest' from incompatible pointer type [-Wincompatible-pointer-types]
  161 |         jpeg_mem_dest (&cinfo, &jpeg_header, &jpeg_header_size);
      |                                              ^~~~~~~~~~~~~~~~~
      |                                              |
      |                                              long unsigned int *

Fixes:
- https://autobuild.buildroot.org/results/cb983d9ad90170aa8d7f2b9a5dfc30055d83b5de

Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Tested-by: Edgar Bonet <bonet@grenoble.cnrs.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit d2ad5b8833)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-29 10:26:14 +02:00
Giulio Benetti
33ec270f8a package/libnss: fix Makefile ifndef FREEBL_NO_DEPEND
NSS Makefile build system is pretty weak if used with parallel build. In
this case what happens is that 'ifndef FREEBL_NO_DEPEND' appears in
lib/freebl/manifest.mn and coreconf/Linux.mk. When parallel building
variable FREEBL_NO_DEPEND gets defined if not defined to 1, but in the
2 occurences we end up having on variable set to 1 and 1 still not
defined. This results in:
`
/home/giuliobenetti/br-reproduce/3e046c996825447f48377f7c4361b5db26b84f95/output/host/lib/gcc/arm-buildroot-linux-musleabi/14.3.0/../../../../arm-buildroot-linux-musleabi/bin/ld: Linux2.6_arm_arm-buildroot-linux-musleabi-gcc.br_real_glibc_PTH_DBG.OBJ/Linux_SINGLE_SHLIB/lowhash_vector.o: in function `loader_GetOriginalPathname':
lowhash_vector.c:(.text.loader_GetOriginalPathname+0x68): undefined reference to `PR_SetError'
collect2: error: ld returned 1 exit status
`
So let's pass FREEBL_NO_DEPEND=1 when building to define that variable
instead to let NSS Makefile to calculate it.

Fixes:
https://autobuild.buildroot.net/results/ad4/ad40536728303c56d1d0968e38ac36da12cca416//

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit 6d3cc38ec0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-29 10:26:12 +02:00
Bernd Kuhls
66127b61bb package/sed: security bump version to 4.10
https://lists.gnu.org/archive/html/sed-devel/2026-04/msg00027.html
"'sed --follow-symlinks -i' no longer has a TOCTOU race [...]"

Fixes CVE-2026-5958: https://cert.pl/en/posts/2026/04/CVE-2026-5958/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit eb496bd63e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-29 10:26:10 +02:00
Bernd Kuhls
3c502cc273 package/intel-microcode: security bump version to 20260512
https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20260512

Fixes CVE-2025-35979:
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01420.html

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 3dfde73b67)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-29 10:26:08 +02:00
Bernd Kuhls
6d5e591cdf package/intel-microcode: bump version to 20260227
https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20260227

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f489b40190)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-29 10:26:06 +02:00
Thomas Perale
726c6f9591 package/python-cbor2: add CPE ID
The "cpe:2.3:a:agronholm:cbor2:*:*:*:*:*:python:*:*" is a valid CPE
[1][2] for this package.

[1] https://nvd.nist.gov/products/cpe/detail/C9CB66BA-6D92-430D-B3A8-D20C43E0655C
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-26209

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 140d618567)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-29 10:26:03 +02:00
Thomas Perale
b2d223c9fc package/mongoose: fix typo in CPE vendor
There is no CVE assigned with the vendor name "cesenta".

The CPE ID introduced in [1], correctly reference "cesanta" as a CPE
vendor but introduced a typo while writing the vendor metadata in
`mongoose.mk`.

[1] 3d632c941f package/mongoose: add MONGOOSE_CPE_ID_VENDOR

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit de4044a0c9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-29 10:26:01 +02:00
Thomas Perale
9bedf714a0 package/libvncserver: patch CVE-2026-3285{3, 4}
- CVE-2026-32853:
    LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e)
    contain a heap out-of-bounds read vulnerability in the UltraZip
    encoding handler that allows a malicious VNC server to cause
    information disclosure or application crash. Attackers can exploit
    improper bounds checking in the HandleUltraZipBPP() function by
    manipulating subrectangle header counts to read beyond the allocated
    heap buffer.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2026-32853
  - https://github.com/LibVNC/libvncserver/security/advisories/GHSA-87q7-v983-qwcj
  - 009008e2f4

- CVE-2026-32854:
    LibVNCServer versions 0.9.15 and prior (fixed in commit dc78dee)
    contain null pointer dereference vulnerabilities in the HTTP proxy
    handlers within httpProcessInput() in httpd.c that allow remote
    attackers to cause a denial of service by sending specially crafted
    HTTP requests. Attackers can exploit missing validation of strchr()
    return values in the CONNECT and GET proxy handling paths to trigger
    null pointer dereferences and crash the server when httpd and proxy
    features are enabled.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2026-32854
  - https://github.com/LibVNC/libvncserver/security/advisories/GHSA-xjp8-4qqv-5x4x
  - dc78dee51a

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 258128aefe)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-29 10:25:59 +02:00
Bernd Kuhls
483dcc9be8 package/libmodsecurity: security bump version to 3.0.15
https://github.com/owasp-modsecurity/ModSecurity/blob/v3.0.15/CHANGES

Fixes CVE-2026-42268 & CVE-2026-30923.

Rebased patch 0001 due to upstream commit
f38b5b7296

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e00d34dcc9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-29 10:25:57 +02:00
Bernd Kuhls
f01bf75c6b package/liburiparser: security bump version to 1.0.2
https://github.com/uriparser/uriparser/blob/uriparser-1.0.2/ChangeLog

Fixes CVE-2026-44927 & CVE-2026-44928.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f328822cf1)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-29 10:25:55 +02:00
Shubham Chakraborty
efee1ec453 package/dos2unix: update upstream URLs
The old upstream page [1] is being deprecated. It currently shows:
"""
This page will go offline on 1 July 2026. Go to the new page at
https://waterlander.net/dos2unix/
"""

This commit updates the homepage, download site and hash file URL
to the new upstream location [2].

[1] http://waterlan.home.xs4all.nl/dos2unix.html
[2] https://waterlander.net/dos2unix/

Signed-off-by: Shubham Chakraborty <chakrabortyshubham66@gmail.com>
[Julien: add info in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 44f60e9f70)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-29 10:25:53 +02:00
Bernd Kuhls
b09763e6d9 package/dnsmasq: security bump version to 2.92rel2
https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2026q2/018471.html
https://thekelleys.org.uk/dnsmasq/CVE/

Fixes CVE-2026-2291, CVE-2026-4890, CVE-2026-4891, CVE-2026-4892,
CVE-2026-4893 & CVE-2026-5172.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 6be9c7e9cf)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-29 10:25:51 +02:00
Bernd Kuhls
b1c6148803 package/libgpg-error: security bump version to 1.61
https://github.com/gpg/libgpg-error/blob/libgpg-error-1.61/NEWS
https://dev.gnupg.org/T8239
https://lwn.net/Articles/1071807/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 78a93cfa9b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-29 10:25:49 +02:00
Bernd Kuhls
9efcaa28af package/libgpg-error: bump version to 1.60
https://dev.gnupg.org/T8112

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit c41092cc98)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-29 10:25:47 +02:00
Thomas Perale
509daa69c0 package/{glibc, localedef}: security bump to version glibc-2.42-67-g4ebd33dd7
Fixes the following vulnerabilities:

- CVE-2026-4046:
    The iconv() function in the GNU C Library versions 2.43 and earlier
    may crash due to an assertion failure when converting inputs from the
    IBM1390 or IBM1399 character sets, which may be used to remotely crash
    an application.    This vulnerability can be trivially mitigated by
    removing the IBM1390 and IBM1399 character sets from systems that do
    not need them.

For more information, see:
  - glibc-2.42-62-gf13c1bb0f97fbc12a6ba1ab5669ce561ea32b80a
  - https://www.cve.org/CVERecord?id=CVE-2026-4046

- CVE-2026-4437:
    Calling gethostbyaddr or gethostbyaddr_r with a configured
    nsswitch.conf that specifies the library's DNS backend in the GNU C
    Library version 2.34 to version 2.43 could, with a crafted response
    from the configured DNS server, result in a violation of the DNS
    specification that causes the application to treat a non-answer
    section of the DNS response as a valid answer.

For more information, see:
  - glibc-2.42-58-g8e863fb1c92360520704a69dc948be6bb4a17cb3
  - https://www.cve.org/CVERecord?id=CVE-2026-4437

- CVE-2026-4438:
    Calling gethostbyaddr or gethostbyaddr_r with a configured
    nsswitch.conf that specifies the library's DNS backend in the GNU C
    library version 2.34 to version 2.43 could result in an invalid DNS
    hostname being returned to the caller in violation of the DNS
    specification.

For more information, see:
  - glibc-2.42-59-g426378547e6ddead92f28f5558a124eb0821d2f9
  - https://www.cve.org/CVERecord?id=CVE-2026-4438

- CVE-2026-5450:
    Calling the scanf family of functions with a %mc (malloc'd character
    match) in the GNU C Library version 2.7 to version 2.43 with a format
    width specifier with an explicit width greater than 1024 could result
    in a one byte heap buffer overflow.

For more information, see:
  - glibc-2.42-67-g4ebd33dd77eabe8d4c45232bed4b42a31d2f9edc
  - https://www.cve.org/CVERecord?id=CVE-2026-5450

- CVE-2026-5928:
    Calling the ungetwc function on a FILE stream with wide characters
    encoded in a character set that has overlaps between its single byte
    and multi-byte character encodings, in the GNU C Library version 2.43
    or earlier, may result in an attempt to read bytes before an allocated
    buffer, potentially resulting in unintentional disclosure of
    neighboring data in the heap, or a program crash.  A bug in the wide
    character pushback implementation (_IO_wdefault_pbackfail in
    libio/wgenops.c) causes ungetwc() to operate on the regular character
    buffer (fp->_IO_read_ptr) instead of the actual wide-stream read
    pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen
    in cases where fp->_IO_read_ptr is not initialized and hence points to
    NULL. The buffer under-read requires a special situation where the
    input character encoding is such that there are overlaps between
    single byte representations and multibyte representations in that
    encoding, resulting in spurious matches. The spurious match case is
    not possible in the standard Unicode character sets.

For more information, see:
  - glibc-2.42-66-gb4bca35ab9e76890504c4dbdd5eaf15a93514580
  - https://www.cve.org/CVERecord?id=CVE-2026-5928

> git shortlog 2.42-51-gcbf39c26b25801e9bc88499b4fd361ac172d4125..2.42-67-g4ebd33dd77eabe8d4c45232bed4b42a31d2f9edc

Carlos O'Donell (2):
      resolv: Count records correctly (CVE-2026-4437)
      resolv: Check hostname for validity (CVE-2026-4438)

DJ Delorie (1):
      include: isolate __O_CLOEXEC flag for sys/mount.h and fcntl.h

Florian Weimer (8):
      Switch currency symbol for the bg_BG locale to euro
      nss: Introduce dedicated struct nss_database_for_fork type
      Linux: In getlogin_r, use utmp fallback only for specific errors
      nss: Missing checks in __nss_configure_lookup, __nss_database_get (bug 28940)
      iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module
      posix: Run tst-wordexp-reuse-mem test
      Use pending character state in IBM1390, IBM1399 character sets (CVE-2026-4046)
      Linux: Only define OPEN_TREE_* macros in <sys/mount.h> if undefined (bug 33921)

H.J. Lu (1):
      abilist.awk: Handle weak unversioned defined symbols

Michael Jeanson (1):
      tests: fix tst-rseq with Linux 7.0

Rocket Ma (2):
      libio: Fix ungetwc operating on byte stream [BZ #33998]
      stdio-common: Fix buffer overflow in scanf %mc [BZ #34008]

Xi Ruoyao (1):
      elf: parse /proc/self/maps as the last resort to find the gap for tst-link-map-contiguous-ldso

(cherry picked from commit e3c662eac9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-29 10:25:45 +02:00
Bernd Kuhls
81211883ff package/python3: security bump version to 3.14.5
https://www.python.org/downloads/release/python-3145/
https://docs.python.org/release/3.14.5/whatsnew/changelog.html

This release includes various security fixes:

gh-148178: Hardened _remote_debugging by validating remote debug offset
 tables before using them to size memory reads or interpret remote
 layouts.
gh-149254: Update Android and iOS installer to use OpenSSL 3.0.20.
gh-149017: Update bundled libexpat to version 2.8.0.
gh-90309: Base64-encode values when embedding cookies to JavaScript
 using the http.cookies.BaseCookie.js_output() method to avoid injection
 and escaping.
gh-148395: Fix a dangling input pointer in lzma.LZMADecompressor,
 bz2.BZ2Decompressor, and internal zlib._ZlibDecompressor when memory
 allocation fails with MemoryError, which could let a subsequent
 decompress() call read or write through a stale pointer to the already-
released caller buffer.
gh-148169: A bypass in webbrowser allowed URLs prefixed with %action to
 pass the dash-prefix safety check.
gh-146333: Fix quadratic backtracking in configparser.RawConfigParser
 option parsing regexes (OPTCRE and OPTCRE_NV). A crafted configuration
 line with many whitespace characters could cause excessive CPU usage.
gh-146211: Reject CR/LF characters in tunnel request headers for the
 HTTPConnection.set_tunnel() method.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit ced8d46573)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-29 10:25:43 +02:00
Bernd Kuhls
530536139a package/dropbear: bump version to 2026.91
https://lists.ucc.gu.uwa.edu.au/pipermail/dropbear/2026q2/002398.html

This bump includes
"- scp: Fix regression in 2026.90 building on older glibc or other libc.
  reallocarray() was required, it is no longer needed."

and fixes a build error introduced by buildroot commit
5b136c89ff.

Fixes:
https://autobuild.buildroot.net/results/637/6372e58671d3719b127dcb69642420a07f441790/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Reviewed-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 4254d4fd82)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-29 10:25:41 +02:00
Francois Perrad
a780e6094a package/expat: security bump to version 2.8.1
fixes CVE-2026-45186

see https://github.com/libexpat/libexpat/blob/R_2_8_1/expat/Changes

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit a96ad6205b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-29 10:25:38 +02:00
Thomas Perale
81ce186262 package/dropbear: security bump to version 2026.90
https://github.com/mkj/dropbear/releases/tag/DROPBEAR_2026.90
https://matt.ucc.asn.au/dropbear/CHANGES

Fixes CVE-2019-6111 & CVE-2026-35385.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 5b136c89ff)
[thomas: reverts commit 3db14ab765]
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-29 10:25:36 +02:00
Arnout Vandecappelle
71d1dddae1 Makefile: Update for 2026.02.2
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2026-05-20 14:02:52 +02:00
Arnout Vandecappelle
9bf4d998d8 CHANGES: Update for 2026.02.2
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2026-05-20 12:01:57 +02:00
Titouan Christophe
d1d3cf26d2 {linux, linux-headers}: bump 6.12.x, 6.6.x, 6.1.x, 5.15.x, 5.10.x, 6.18.x series
Update the latest kernel releases to:
 - 6.12.84 -> 6.12.90
 - 6.6.136 -> 6.6.140
 - 6.1.169 -> 6.1.173
 - 5.15.203 -> 5.15.207
 - 5.10.253 -> 5.10.256
 - 6.18.25 -> 6.18.32

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2026-05-18 14:18:59 +02:00
Peter Korsgaard
f204a67337 package/go-bootstrap-stage5: security bump to version 1.25.10
Fixes the following security issues:

CVE-2026-33811: net: crash when handling long CNAME response
CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad
                SETTINGS_MAX_FRAME_SIZE
CVE-2026-39817: cmd/go: "go tool pack" does not sanitize output paths
CVE-2026-39819: md/go: "go bug" follows symlinks in predictable temporary
                filenames
CVE-2026-39820: net/mail: quadratic string concatenation in consumeComment
CVE-2026-39823: html/template: bypass of meta content URL escaping causes
                XSS
CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries with more
                than urlmaxqueryparams parameters
CVE-2026-39826: html/template: escaper bypass leads to XSS
CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL byte on
                Windows
CVE-2026-42499: net/mail: quadratic string concatenation in consumePhrase
CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database

go1.25.10 (released 2026-05-07) includes security fixes to the go command,
the pack tool, and the html/template, net, net/http, net/http/httputil,
net/mail, and syscall packages, as well as bug fixes to the go command, the
compiler, the linker, the runtime, and the crypto/fips140, go/types, and os
packages.

https://go.dev/doc/devel/release#go1.25.10

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Reviewed-by: Christian Stewart <christian@aperture.us>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit c19e6d80fb)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:52:42 +02:00
Peter Korsgaard
e876211a23 package/go: security bump to version 1.26.3
Fixes the following security issues:

CVE-2026-33811: net: crash when handling long CNAME response
CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad
                SETTINGS_MAX_FRAME_SIZE
CVE-2026-39817: cmd/go: "go tool pack" does not sanitize output paths
CVE-2026-39819: md/go: "go bug" follows symlinks in predictable temporary
                filenames
CVE-2026-39820: net/mail: quadratic string concatenation in consumeComment
CVE-2026-39823: html/template: bypass of meta content URL escaping causes
                XSS
CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries with more
                than urlmaxqueryparams parameters
CVE-2026-39826: html/template: escaper bypass leads to XSS
CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL byte on
                Windows
CVE-2026-42499: net/mail: quadratic string concatenation in consumePhrase
CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database

go1.26.3 (released 2026-05-07) includes security fixes to the go command,
the pack tool, and the html/template, net, net/http, net/http/httputil,
net/mail, and syscall packages, as well as bug fixes to the go command, the
go fix command, the compiler, the linker, the runtime, and the
crypto/fips140, crypto/tls, go/types, and os packages.

https://go.dev/doc/devel/release#go1.26.3

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit c465f0d8eb)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:52:37 +02:00
Bernd Kuhls
c023dc644a package/php: security bump version to 8.5.6
https://www.php.net/ChangeLog-8.php#8.5.6
https://news-web.php.net/php.announce/492
https://github.com/php/php-src/blob/php-8.5.6/NEWS

Fixes CVE-2026-7263, CVE-2026-6735, CVE-2026-29078, CVE-2026-29079,
CVE-2026-7259, CVE-2026-6104, CVE-2025-14179, CVE-2026-6722,
CVE-2026-7261, CVE-2026-7262, CVE-2026-7568, CVE-2026-7258 &
CVE-2026-42371.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 952aa90078)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:50:06 +02:00
Adrian Perez de Castro
7e18e31220 package/bubblewrap: security bump to version 0.11.2
Fixes CVE-2026-41163, which affects any system using bubblewrap 0.11.x
using a setuid bubblewrap.

Release notes:

  https://github.com/containers/bubblewrap/releases/tag/v0.11.2

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 108f51c1b3)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:50:01 +02:00
Adrian Perez de Castro
f072a76ef4 package/bubblewrap: bump version to 0.11.1
Release notes:

  https://github.com/containers/bubblewrap/releases/tag/v0.11.1

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit ead0c6b182)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:48:38 +02:00
Bernd Kuhls
cf87728c01 package/tor: security bump version to 0.4.9.8
Version 0.4.9.7 fixes the following security bugs:
https://gitlab.torproject.org/tpo/core/tor/-/blob/tor-0.4.9.7/ReleaseNotes

Fixes TROVE-2026-011, TROVE-2026-010, TROVE-2026-009, TROVE-2026-008,
TROVE-2026-007, TROVE-2026-006:
https://gitlab.torproject.org/tpo/core/team/-/wikis/NetworkTeam/TROVE

Version 0.4.9.8 fixes a bug introduced by the bump to 0.4.9.7:
https://gitlab.torproject.org/tpo/core/tor/-/blob/tor-0.4.9.8/ReleaseNotes

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 15fbc52884)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:47:10 +02:00
Bernd Kuhls
3663999399 package/wireless-regdb: bump version to 2026.03.18
https://lists.infradead.org/pipermail/wireless-regdb/2026-March/001844.html

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 3db2f0b33c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:47:01 +02:00
Peter Korsgaard
9989e25158 package/xlib_libXpm: security bump to version 3.5.19
Fixes the following vulnerability:

CVE-2026-4367: libXpm Out-of-bounds read in xpmNextWord()

libXpm uses a number of internal helper functions to parse the XPM file
format.
One of these internal functions, xpmNextString(), checks for the NULL
terminator when looking for the end of the current string but not when
looking for the beginning of the next string.
A small XPM file with a malformed color table definition may cause the
function xpmNextWord(), called from xpmParseColors() following a call to
xpmNextString(), to start past the actual end of the file, causing an
out-of-bound read.

Advisory:
https://lists.x.org/archives/xorg-announce/2026-April/003690.html

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 3aa75c99c1)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:45:49 +02:00
Marcus Hoffmann
d2e399c674 package/gcc: fix gcc-13 build with host gcc 16
Backport 2 patches from upstream maintenance branch. Same fixes as
required for gcc-14.

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 10ccbe079c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:45:40 +02:00
Marcus Hoffmann
2171dafd28 package/gcc: fix gcc-14 build with host gcc 16
Backport two patches from upstream gcc-14 maintenance branch. Requires
one more patch on top of the fix for gcc-15.

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit dee4991cd1)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:45:33 +02:00
Marcus Hoffmann
ae07c3c72b package/gcc: fix gcc-15 build with host gcc 16
Backport patch that was applied upstream to the gcc-15 maintenance
branch.

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 0dd4196fa0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:45:24 +02:00
Marcus Hoffmann
742c874f67 package/python-django: security bump to 6.0.5
Django 6.0.5 fixes three security issues with severity “low” and several bugs in 6.0.4.

Security Fixes:
* CVE-2026-5766: Potential denial-of-service vulnerability in ASGI
    requests via file upload limit bypass ASGI requests with a missing
    or understated Content-Length header could bypass the
    FILE_UPLOAD_MAX_MEMORY_SIZE limit, potentially loading large files into
    memory and causing service degradation.

    As a reminder, Django expects a limit to be configured at the web server
    level rather than solely relying on FILE_UPLOAD_MAX_MEMORY_SIZE.

    This issue has severity “low” according to the Django security policy

* CVE-2026-35192: Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST
    Response headers did not vary on cookies if a session was not modified,
    but SESSION_SAVE_EVERY_REQUEST was True. A remote attacker could steal a
    user’s session after that user visits a cached public page.

    This issue has severity “low” according to the Django security policy.

* CVE-2026-6907: Potential exposure of private data due to incorrect
    handling of Vary: * in UpdateCacheMiddleware

    Previously, UpdateCacheMiddleware would erroneously cache requests where
    the Vary header contained an asterisk ('*'). This could lead to private
    data being stored and served.

    This issue has severity “low” according to the Django security policy.

Bugfixes:
* Fixed a misplaced </div> in the
  django/contrib/admin/templates/admin/change_list.html template added
  in Django 6.0 that could be problematic when overriding the pagination
  block (#37029).
* Fixed a bug in Django 6.0 where deprecation warnings incorrectly
  skipped lines from third-party packages prefixed with “django”
  (#37067).

Release notes: https://docs.djangoproject.com/en/6.0/releases/6.0.5/

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 4fe009b6aa)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:44:56 +02:00
Alexis Lothoré
440738e291 package/frr: install systemd service files
The FRR package currently only installs systemv services files. The
upstream package also provides a systemd service file and a service
template file. Install those when systemd is selected as an init
manager.

Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit 5af981a672)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:25:56 +02:00
Giulio Benetti
6e4668c060 package/ffmpeg: securty bump version to 6.1.5
Fixes: CVE-2026-30997 - FFmpeg AV1 Decoding Out-of-Bounds Read Vulnerability [1]

Full changelog: https://code.ffmpeg.org/FFmpeg/FFmpeg/src/tag/n6.1.5/Changelog

License file hash changed due to removing U+000C unicode characters in [2].

[1] a44ab44236
[2] 735acddb8a

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
[Marcus: mention security fix, use upstream url for changelog instead of videolan mirror]
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit 6cd936b8e7)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:24:03 +02:00
Giulio Benetti
e1b39a1fd3 package/p7zip: security bump to version v17.06
What's Changed:
  - Fix CVE-2021-3520 affected components Lz4 1.9.3 in p7zip17 (#239)

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>a
[Marcus: mark as security bump]
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit 760e16dcc0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:22:43 +02:00
Fiona Klute
cb4e02c6ac support/scripts/pkg-stats: run main function only if called as script
The __name__ == '__main__' guard allows importing pkg-stats as a
module using importlib, circumventing the normal module filename
requirements. This in turn makes it possible to test/debug individual
functions.

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 8cde69e101)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:22:33 +02:00
Fiona Klute
071ba58f00 support/scripts/pkg-stats: don't buffer whole file searching for infra
The file handle can be iterated over directly and each line is used
exactly once, so the only effect of reading all lines into a list
first was higher memory use and complexity.

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 07f7ad9898)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:22:25 +02:00
Fiona Klute
34204529e0 support/scripts/pkg-stats: fix host/target infra filter
The filter is supposed to exclude host/target infra from output if the
respective package is not built with the current
configuration.

However, excluding host packages did not work correctly: If keep_host
is False because the host package is not built, the next branch was
checked and included the host infra in output with "target" type if
the target package is built. For a package that support host and
target build, but gets built only for the target, this leads to output
like (Meson example):

meson (target)
host-meson (target)

Skip host infra in the target branch instead. Also include
Package.infra in Package.__str__() result, which was needed for
debugging this bug.

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit e8dcebf459)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:22:14 +02:00
Fiona Klute
6ea66ebd69 linux/Config.in: add kernel.org URL to help
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
[Arnout: add it to the main help text, where it belongs]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 2ab95cf0ee)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:21:58 +02:00
Fiona Klute
056588171d support/scripts/pkg-stats: format upstream URL info consistently in HTML
Use only one of the classes for "error" or "warning" status so they
look different, and format the error/warning text for both. Do not
make the text a link if the URL is None.

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 7961bd10b9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:21:43 +02:00
Fiona Klute
54a7730033 support/scripts/pkg-stats: search only Config.in{, .host} for URL
The previous Config.* glob also caught linux/Config.ext.in and
package/php/Config.ext, as well as some backup files created by
editors (e.g. Config.in~ after editing a Config.in file in Emacs),
leading to wrong results depending on directory listing order.

Also use "with" to automatically close the file when the block is
left, even on error.

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 77a464969c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:21:12 +02:00
Martin Kepplinger-Novaković
9a29752770 DEVELOPERS: remove Martin Kepplinger from x11vnc
I don't use maintain x11vnc in buildroot anymore and can't easily test.

Signed-off-by: Martin Kepplinger-Novaković <martink@posteo.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 81e72115a0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:20:39 +02:00
Fiona Klute
699d4cfd7f package/eudev: fix install with BR2_ROOTFS_MERGED_BIN=y
Eudev install creates a symlink from $(sbindir)/udevadm to
$(bindir)/udevadm if sbindir and bindir are different [1].
Unfortunately the check considers only the configured values as
strings and does not resolve symlinks. This means that in a merged-bin
setup with sbindir=/sbin (symlink to /usr/sbin, which is a symlink to
/usr/bin) and bindir=/usr/bin the /usr/bin/udevadm binary gets
overwritten with a link to itself.

Set sbindir according to the merge setup to avoid the problem, bindir
defaults to /usr/bin in any case.

[1] 9e7c4e744b/src/udev/Makefile.am (L139-L140)

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit a063c89dc2)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:20:22 +02:00
Fiona Klute
0d8372b7e0 package/watchdogd/S01watchdogd: immediately return if sending stop fails
If sending the stop signal fails but the PID file exists the following
shutdown wait turns into an endless loop. Avoid that and return the
error immediately.

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit 6558eb3d65)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:20:15 +02:00
Fiona Klute
c272ee972b package/openssh/S50sshd: immediately return if sending stop fails
If sending the stop signal fails but the PID file exists the following
shutdown wait turns into an endless loop. Avoid that and return the
error immediately.

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit 34f4732f1a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:19:52 +02:00
Daniel Houck
dd1ddca614 package/make: fix build with musl and gcc-15.x
Patch the parts of Make that use code invalid in C23.  It wasn't
included when compiling with glibc but failed to build with musl.

Fixes #176.  See also https://savannah.gnu.org/bugs/index.php?68302

Signed-off-by: Daniel Houck <Software@DRHouck.me>
[Marcus: link to savannah bug report also in the patchfile]
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit dff61f65ec)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:19:28 +02:00
Fiona Klute
c7e20789e8 package/openssh: explicitly configure PID file directory
OpenSSH checks during ./configure if the default location /var/run
exists on the build host, and defaults to ${sysconfdir} (/etc/ssh in
Buildroot) if not. This can break e.g. in a sandbox with its own mount
namespace where there is no reason to create a /var.

On the target this leads to errors when starting/stopping the service
from the init script, which expects the PID file at /var/run/sshd.pid if
sshd is running. A "stop" (including as part of "restart") or "reload"
will always fail with

    no /usr/sbin/sshd found; none killed

from start-stop-daemon, even though sshd is running (because the PID
file doesn't exist where start-stop-daemon tries to read it).

On the other hand, a "start" command will try to start sshd even if it
is already running, because it cannot detect the running instance.
Unfortunately sshd does not fail directly in that situation (so the init
script completes), but something like the following appears in the log:

    [May 04 14:48:05] auth sshd[4592]: error: Bind to port 22 on 0.0.0.0
    failed: Address in use.
    [May 04 14:48:05] auth sshd[4592]: error: Bind to port 22 on :: failed:
    Address in use.
    [May 04 14:48:05] auth sshd[4592]: fatal: Cannot bind any address.

Explicitly setting --with-pid-dir=/var/run overrides either default,
and only logs a warning if /var/run does not exist.

[1] 5fa60ae0d2/configure.ac (L5568-L5576)

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
[Marcus: expand commit message after discussion on ML]
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit c09bec68f1)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:18:15 +02:00
Bernd Kuhls
ce4d425a53 package/apache: security bump version to 2.4.67
Changelog:
https://downloads.apache.org/httpd/CHANGES_2.4.67

Fixes CVE-2026-23918, CVE-2026-24072, CVE-2026-28780, CVE-2026-29168,
CVE-2026-29169, CVE-2026-33006, CVE-2026-33007, CVE-2026-33523,
CVE-2026-33857, CVE-2026-34032 & CVE-2026-34059.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit a52df2cc85)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:17:39 +02:00
Peter Korsgaard
07f84877f5 package/mutt: bump version to 2.2.16
Bugfix release fixing crash / NULL pointer access issues and gsasl
authentication compatibility with Microsoft servers.

Mutt 2.2.14 was released on February 20, 2025.  This is a bug-fix release,
fixing a couple possible crashes, in GPGME and with IMAP when logging out,
and correcting a small issue with unnecessary encoding of "." in attachment
names (2231 encoding).

Mutt 2.2.15 was released on October 2, 2025.  This is a bug-fix release,
fixing an IMAP search/limit bug, a compilation issue, and containing a
workaround for gsasl SMTP authentication issues with some MS servers.  A few
parts of the documentation were also improved.

Mutt 2.2.16 was released on November 22, 2025.  This is a bug-fix release,
fixing a resource leak when compiled with OpenSSL/LibreSSL, which could
eventually result in new connections failing.

http://www.mutt.org/news.html

The 2.2.16 release is not available on bitbucket, so change to the official
ftp.mutt.org location instead.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 206cd3cd31)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:17:11 +02:00
Peter Korsgaard
2748583c04 package/haproxy: bump version to 6.2.27
Bugfix release with large number of (security) fixes.

For 6.2.26:

- a severe issue was found in the compression library (slz) where
    specially crafted patterns with tune.bufsize above 17408 or
    tune.maxrewrite below 964 (both non-default) could cause output
    buffer overflows due to the overhead exceeding the promised
    worst-case growth bound of 5 bytes and reach up to 1/16 of the
    input contents. Given that the compression output is hardly
    controllable, and the canaries at the end of the pools will catch
    this at release time, the risk of exploitation by a hostile server
    is close to zero, however it will cause repeated crashes if such a
    crafted file is present on a server and regularly downloaded. A
    workaround consists in keeping tune.maxrewrite at least 1/16 of
    tune.bufsize or just not changing them since the defaults are safe.
    A CVE was requested two weeks ago for this one, I'll mention it when
    it arrives.

  - HTTP/2 incomplete transfer detection was missing for HEADERS frames
    carrying END_STREAM. When relayed to an HTTP/1.1 server that
    responds before the end of the transfer, this can result in bytes
    of the next request over the same connection to be ignored. Most of
    the time it will cause the connection to be dropped due to an
    unparsable request, but when combined with "http-reuse never", or
    on totally idle servers, the client could expect the second request
    to reuse the same connection and perform a content smuggling attack
    that would allow to pass an unverified request to a server. For
    those who can't upgrade, a temporary workaround is to disable
    HTTP/2 by specifying "alpn http/1.1" on bind lines and adding
    "disable-h2-upgrade" in HTTP frontends. A CVE will be requested for
    this one.

  - HTTP/1.1 bodyless messages announcing a non-null Content-Length did
    not force close mode on the backend, potentially causing
    desynchronisation between HAProxy and the server in conjunction
    with other bugs.

  - FCGI record length truncation with large bufsize (>=65544) could
    enable request smuggling into PHP-FPM since the 16-bit
    content_length field silently truncated to 65535 bytes.

  - an unvalidated SNI name_len field in ClientHello could cause OOB
    heap reads of up to 65KB via XXH3, smp_dup(), and log-format leaks
    on any TCP frontend using req.ssl_sni, possibly causing crashes when
    used.

  - ECDSA JWT signatures with ES256/384/512 could cause a heap overflow
    of ~14 bytes in the DER conversion before verification.

  - Lua's httpclient headers conversion accepted more than 101 headers
    without bound checking, causing a stack buffer overflow reachable
    from any Lua action/task/service.

  - peers dictionary cache updates accepted an unvalidated entry id as
    array index, allowing OOB heap writes at attacker-controlled
    offsets.

  - Lua had a use-after-free of HTTP reason strings managed by Lua's GC
    between set_status() and start_response(), potentially leaking
    adjacent information from memory.

  - the regsub sample function could leak ~9-50KB of stale heap data
    when back-reference expansion overflowed the output buffer.

  - SPOE decode_varint() had no iteration cap, allowing pointer
    arithmetic to wrap and dereference memory ~64KB before the
    allocation, causing SIGSEGV or parser confusion.

  - in sample expressions, less common HTTP methods (PATCH etc.) are
    represented by both an enum and a string. The string part was not
    handled correctly in sample duplication functions, resulting in
    their contents appearing empty when trying to fetch the method.

  - QPACK varint decoding is now also limited to 62-bit, and had a risk
    of 1-byte OOB reads on truncated streams, which could cause
    incorrect header decoding.

  - config: a few argument parsing errors in conditional expressions
    used in ".if" could be misreported and even cause a crash during
    the parsing. Also, a few keywords relying on warnif_misplaced_*
    didn't check the return value and didn't count emitted warnings as
    warnings.

For more details, see the announcement:
https://www.mail-archive.com/haproxy@formilux.org/msg47016.html

For 6.2.27:

A major issue were fixed by this release. It was related to the scheme-based
normalization. The presence of commas in Host header and authority was permitted
and would be used to compare the values, which then would differ when read via
hdr(host) which splits them on commas, and under certain circumstances, trigger
crashes (at least it did in the OSS-Fuzz environment when injecting the values
directly at the HTX layer). The issue was fixed.  Remains the case of the comma
characters in authorities. Even though the spec permits commas in authorities
(not in domain names), there is currently no use case for this and it causes an
ambiguity with the historical use of hdr(host), so we preferred to just deny
them. The change was performed on the 3.4-dev10 and postponed for the next 3.3
release. It will probably be backported to lower versions too.

An issue in the FCGI multiplexer was fixed. The function responsible to emit
FCGI_PARAM records was not handling cases of full buffer in a consistent
way. The issue was quite limited, but the "http-send-name-header" option could
be silently ignored. The issue was fixed by reworking this function.

The scheme-based normalization was fixed to properly handle case of OPTIONS
requests. As stated in RFC9110#4.2.3, when the scheme-based normalization is
performed, an empty path must be normalized to "/", except for OPTIONS request.

Finally, a memory leak on error path (tools) and other minor issues were also
fixed.

For more details, see the announcement:
https://www.mail-archive.com/haproxy@formilux.org/msg47059.html

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 22f1e90d6b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:16:31 +02:00
Bernd Kuhls
5b6a0d9c6b package/haproxy: bump version to 2.6.25
http://www.haproxy.org/download/2.6/src/CHANGELOG

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 85f1e9cf0b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 16:16:22 +02:00
Bernd Kuhls
4d173cc6e3 package/python-pyopenssl: security bump version to 26.1.0
https://github.com/pyca/pyopenssl/blob/26.1.0/CHANGELOG.rst

Version 26.1.0 fixes CVE-2026-40475
Version 26.0.0 fixes CVE-2026-27459 & CVE-2026-27448.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 7bcba8498b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 15:30:37 +02:00
Bernd Kuhls
2a872f3032 package/libpjsip: security bump version to 2.17
https://github.com/pjsip/pjproject/releases/tag/2.17

Fixes the following CVEs:

CVE-2026-25994, CVE-2026-26203, CVE-2026-26967, CVE-2026-29068,
CVE-2026-28799, CVE-2026-32942, CVE-2026-32945, CVE-2026-33069,
CVE-2026-34235, CVE-2026-40614, CVE-2026-40892, CVE-2026-41416,
CVE-2026-41415, CVE-2026-42225.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit e1f77168d1)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 14:27:17 +02:00
Bernd Kuhls
9da6e86831 package/libpjsip: enable parallel builds
Parallel builds were disabled in 2016 by buildroot commit
781ce19d74.

In 2020 upstream added two commits which fix parallel builds
ddf48e2045
78683646c8
to version 2.11 which was added to buildroot with commit
2c7ad667ec.

Tested with -j100.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit 3ddeb7a9d3)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 13:59:31 +02:00
Shubham Chakraborty
44336bb9a7 package/nginx: security bump to version 1.28.3
Fixes the following security issues:
- CVE-2026-27654: Buffer overflow in ngx_http_dav_module when using the
  alias directive with WebDAV COPY or MOVE requests.
- CVE-2026-27784 & CVE-2026-32647: Buffer overflows in ngx_http_mp4_module
  when processing specially crafted MP4 files.
- CVE-2026-27651: NULL pointer dereference in the mail proxy module
  during CRAM-MD5 or APOP authentication retries.
- CVE-2026-28753: DNS PTR record manipulation in auth_http or SMTP proxy.
- CVE-2026-28755: OCSP certificate check bypass in the stream module.

For a full list of changes, see:
https://nginx.org/en/CHANGES-1.28

Signed-off-by: Shubham Chakraborty <chakrabortyshubham66@gmail.com>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit 8008da299f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-15 13:59:29 +02:00
Bernd Kuhls
68b0084932 package/netsnmp: enable parallel build
Buildroot commit 7643670052 disabled
parallel builds in 2012.

Upstream fixed the problem in 2021:
855e1c28da
9ea3d8b93c
with version 5.9.1 which was added to buildroot with commit
83b4337354.

Tested with -j100.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit ae4c2baab9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-13 14:53:36 +02:00
Shubham Chakraborty
4ed87fcf74 DEVELOPERS: add Shubham Chakraborty as dos2unix maintainer
Add entry for package/dos2unix/

Signed-off-by: Shubham Chakraborty <chakrabortyshubham66@gmail.com>
[Julien: reword commit title]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 9f3097bcf6)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-13 14:53:22 +02:00
Bernd Kuhls
9dbdc05a97 package/libsodium: security bump version to 1.0.22
https://github.com/jedisct1/libsodium/releases/tag/1.0.22-RELEASE
https://github.com/jedisct1/libsodium/releases/tag/1.0.21-RELEASE

Updated license hash due to copyright year bump:
80c6bab451

Switched to bz2 tarball provided by upstream.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d4d46b275c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-13 14:50:48 +02:00
Thomas Perale
3db14ab765 package/dropbear: patch CVE-2019-6111 CVE-2026-35385
While CVE-2019-6111 was already fixed in 2025.89, the version 2026.90
provided a follow up of that fix.

Note that the author provided this note with this patch:

> Note breaking change: "-r" is now disallowed when the target directory exists
> (an additional change in Dropbear's version). If that's required an alternative
> such as rsync could be used.

Adapt your usage of dropbear accordingly.

- CVE-2019-6111:
    An issue was discovered in OpenSSH 7.9. Due to the scp implementation
    being derived from 1983 rcp, the server chooses which
    files/directories are sent to the client. However, the scp client only
    performs cursory validation of the object name returned (only
    directory traversal attacks are prevented). A malicious scp server (or
    Man-in-The-Middle attacker) can overwrite arbitrary files in the scp
    client target directory. If recursive operation (-r) is performed, the
    server can manipulate subdirectories as well (for example, to
    overwrite the .ssh/authorized_keys file).

For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2019-6111

- CVE-2026-35385:
    In OpenSSH before 10.3, a file downloaded by scp may be installed
    setuid or setgid, an outcome contrary to some users' expectations, if
    the download is performed as root with -O (legacy scp protocol) and
    without -p (preserve mode).

For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2026-35385

[1] https://github.com/mkj/dropbear/releases/tag/DROPBEAR_2026.90

(cherry picked from commit 5b136c89ff)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-13 14:49:54 +02:00
Bernd Kuhls
c8321c0500 package/python-requests: security bump version to 2.33.1
https://github.com/psf/requests/releases/tag/v2.33.1

https://github.com/psf/requests/releases/tag/v2.33.0
Fixes CVE-2026-25645.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit b595f48fd9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-13 14:47:59 +02:00
Bernd Kuhls
f7794333cb package/python-pyasn1: security bump version to 0.6.3
https://github.com/pyasn1/pyasn1/blob/v0.6.3/CHANGES.rst

Fixes CVE-2026-30922.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 123136b246)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-13 14:37:39 +02:00
Bernd Kuhls
5b4194680c package/python-lmdb: security bump version to 2.2.0
https://github.com/jnwatson/py-lmdb/blob/py-lmdb_2.2.0/ChangeLog

Version 2.1.0 fixes the following CVEs:

- **CVE-2019-16224**: heap buffer overflow via `MDB_DUPFIXED` without
    `MDB_DUPSORT` in on-disk `md_flags`. (#429)

- **CVE-2019-16225**: `SIGSEGV` from `P_DIRTY` flag set on mmap'd disk pages,
    causing `mdb_page_touch()` to skip copy-on-write. (#429)

- **CVE-2019-16226**: out-of-bounds `memmove` in `mdb_node_del` via corrupt
    `mn_hi` making `NODEDSZ()` huge. (#429)

- **CVE-2019-16227**: NULL pointer dereference of `mc_xcursor` when
    `F_DUPDATA` is set on a node in a non-DUPSORT database. (#429)

- **CVE-2019-16228**: divide-by-zero from zero `mm_psize` in meta page
    header. (#429)

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 2286c4a02c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-13 14:36:45 +02:00
Bernd Kuhls
1ac609d83e package/python-lmdb: bump version to 1.8.1
https://github.com/jnwatson/py-lmdb/blob/py-lmdb_1.8.1/ChangeLog

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 6df86418f5)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-13 14:35:26 +02:00
Bernd Kuhls
39098f7d04 package/python-certifi: bump version to 2026.4.22
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 4662c679e7)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-13 13:57:57 +02:00
Bernd Kuhls
ff38ae4cc7 package/python-certifi: bump version to 2026.2.25
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 81541039cd)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-13 13:57:55 +02:00
Bernd Kuhls
e90e6c7aa9 package/python-cbor2: security bump version to 5.9.0
https://github.com/agronholm/cbor2/blob/5.9.0/docs/versionhistory.rst

Fixes CVE-2026-26209.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit b676a4f51b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-13 13:57:53 +02:00
Giulio Benetti
fc08d9c32c DEVELOPERS: add Giulio Benetti to wireshark
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d230af8bba)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-13 13:57:51 +02:00
Giulio Benetti
465f1dced9 package/wireshark: security bump to v4.4.15
For more information on the version bump, see:
  - https://www.wireshark.org/docs/relnotes/wireshark-4.4.15.html

Fixes the following vulnerabilities:
CVE-2026-5409, CVE-2026-5408, CVE-2026-5406, CVE-2026-5407, CVE-2026-5299,
CVE-2026-5401, CVE-2026-5404, CVE-2026-5403, CVE-2026-5405, CVE-2026-5654,
CVE-2026-5657, CVE-2026-5656, CVE-2026-5653, CVE-2026-6538, CVE-2026-6537,
CVE-2026-6535, CVE-2026-6534, CVE-2026-6533, CVE-2026-6532, CVE-2026-6531,
CVE-2026-6530, CVE-2026-6529, CVE-2026-6527, CVE-2026-6524, CVE-2026-6523,
CVE-2026-6521, CVE-2026-6520, CVE-2026-6519, CVE-2026-6522, CVE-2026-6870,
CVE-2026-6869, CVE-2026-6868.

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 1880965a3b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-13 13:57:49 +02:00
Bernd Kuhls
bef8aefcde package/thrift: security bump version to 0.23.0
https://github.com/apache/thrift/blob/v0.23.0/CHANGES.md

Fixes the following CVEs:

CVE-2026-41636: https://seclists.org/oss-sec/2026/q2/236
CVE-2026-41607: https://seclists.org/oss-sec/2026/q2/237
CVE-2026-41606: https://seclists.org/oss-sec/2026/q2/238
CVE-2026-41605: https://seclists.org/oss-sec/2026/q2/239
CVE-2026-41604: https://seclists.org/oss-sec/2026/q2/240
CVE-2026-41602: https://seclists.org/oss-sec/2026/q2/241
CVE-2026-41603: https://seclists.org/oss-sec/2026/q2/242
CVE-2025-48431: https://seclists.org/oss-sec/2026/q2/243

This commit also adds "Public Domain" in THRIFT_LICENSE, after
upstream commit [1] added a new sha256 implementation with that
license. The LICENSE file hash is also updated accordingly.

[1] 1e5fa4b9b3

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 6935bc7412)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-13 13:57:47 +02:00
Thomas Perale
770b3996ed package/proftpd: patch CVE-2026-42167
- CVE-2026-42167:
    mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute
    arbitrary code via a username, in scenarios where there is logging of
    USER requests with an expansion such as %U, and the SQL backend allows
    commands (e.g., COPY TO PROGRAM).

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-42167
 - https://github.com/proftpd/proftpd/issues/2052
 - af90843baf

The backport was provided by the Fedora Community:
 - https://src.fedoraproject.org/rpms/proftpd/raw/epel9/f/2052.patch

(cherry picked from commit 0d5ce9ed84)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-13 13:57:44 +02:00
Bernd Kuhls
932a344da1 package/gnutls: security bump to version 3.8.13
https://lists.gnupg.org/pipermail/gnutls-help/2026-April/004922.html

Fixes the following CVEs:

CVE-2026-33845
CVE-2026-33846
CVE-2026-3832
CVE-2026-3833
CVE-2026-42009
CVE-2026-42010
CVE-2026-42011
CVE-2026-42012
CVE-2026-42013
CVE-2026-42014
CVE-2026-42015
CVE-2026-5260
CVE-2026-5419

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d459d257c3)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-12 15:45:51 +02:00
Bernd Kuhls
49091c120f package/libcurl: security bump to version 8.20.0
https://curl.se/ch/8.20.0.html
https://curl.se/docs/security.html

Fixes the following CVEs:
https://curl.se/docs/CVE-2026-7168.html
https://curl.se/docs/CVE-2026-7009.html
https://curl.se/docs/CVE-2026-6429.html
https://curl.se/docs/CVE-2026-6276.html
https://curl.se/docs/CVE-2026-6253.html
https://curl.se/docs/CVE-2026-5773.html
https://curl.se/docs/CVE-2026-5545.html
https://curl.se/docs/CVE-2026-4873.html

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 8940fae607)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-12 15:45:29 +02:00
Bernd Kuhls
5751317898 package/exim: security bump version to 4.99.2
https://lists.exim.org/lurker/message/20260429.121733.f58d9686.en.html

Fixes CVEs:

CVE-2026-40684     Possible crash with malicious DNS data when using musl libc

   On systems using musl libc (not glibc) due to an oddity in octal printing
   it is possible to crash the connection instance when malformed DNS data
   is present in PTR records.

CVE-2026-40685     Possible OOB read/write on corrupt JSON in header

   configurations using json operators on invalid externally-provided input
   could trigger heap corruption.

CVE-2026-40686     Possible OOB read with large UTF8 trailing characters

   configurations using utf8 operators on malformed utf8 in headers could
   trigger OOB reads and might trigger some data leak if error
   messages are required for subsequent emails in the current connection
   and similar malformed headers are present.

CVE-2026-40687     Possible OOB read/write with SPA authenticator

   in configurations using the SPA authentication driver to a hostile/compromised
   external SPA/NTLM connnection it is possible to trigger an OOB read/write
   and crash the connection instance or possibly leak heap data to the instance.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 3f6d37ab9a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-12 15:45:04 +02:00
Bernd Kuhls
ccbf9130c5 package/rsync: security bump version to 3.4.2
https://download.samba.org/pub/rsync/NEWS#3.4.2

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 2f9fff2234)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-12 15:44:39 +02:00
Fiona Klute
aa938fe697 Revert "kmod: workaround for microblaze ld bug"
This reverts commit 0d81107f02. The bug
the workaround is for was fixed in binutils 2.29.51 (first release
listed in bfd/ChangeLog after the fix), which is by now far older than
any version supported by Buildroot.

Compile tested with qemu_microblazeel_mmu_defconfig plus
BR2_PACKAGE_KMOD=y.

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit 7653e616f9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-12 15:42:11 +02:00
Francois Perrad
36bc94ee79 package/libpcap: security bump to version 1.10.6
fix CVE-2025-11961: Fix OOBR and OOBW in pcap_ether_aton()

For change log, see:
https://github.com/the-tcpdump-group/libpcap/blob/libpcap-1.10.6/CHANGES

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 146c8a518d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-12 15:40:53 +02:00
Raphael Pavlidis
62ef552dd4 package/linux-pam: security bump to version 1.7.2
Fixes (in 1.7.1): CVE-2025-6020 - pam_namespace: potential privilege escalation

https://github.com/linux-pam/linux-pam/security/advisories/GHSA-f9p8-gjr4-j9gx

The build system was changed from autotools to meson in 1.7.0.

Changelog:
https://github.com/linux-pam/linux-pam/releases/tag/v1.7.0
https://github.com/linux-pam/linux-pam/releases/tag/v1.7.1
https://github.com/linux-pam/linux-pam/releases/tag/v1.7.2

Signed-off-by: Raphael Pavlidis <raphael.pavlidis@gmail.com>
[Marcus: add note about the CVE fixed in this bump]
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit 30e38505e4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-12 15:33:36 +02:00
Bernd Kuhls
8a2fb50682 package/opensc: security bump version to 0.27.1
https://github.com/OpenSC/OpenSC/blob/0.27.1/NEWS

Switched to sha256 tarball hash provided by upstream.

Removed patch which is included in this release.

Fixes the following CVEs:
* CVE-2025-13763: Several uses of potentially uninitialized memory
                  detected by fuzzers
* CVE-2025-49010: Possible write beyond buffer bounds during processing
                  of GET RESPONSE APDU
* CVE-2025-66215: Possible write beyond buffer bounds in oberthur driver
* CVE-2025-66038: Possible read beyond buffer bounds when parsing
                  historical bytes in PIV driver
* CVE-2025-66037: Possible buffer overrun while parsing SPKI

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit baa0a13653)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-12 15:29:44 +02:00
Eugen Hristev
292e1e65d7 DEVELOPERS: Update email for Eugen Hristev
Replace old bouncing email address.

Signed-off-by: Eugen Hristev <ehristev@kernel.org>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit bd9e30470f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-12 15:28:24 +02:00
Fiona Klute
c5a0a71d7c package/initscripts: fix check-package warnings & indent
No functional change. Add package-level .editorconfig so indentation
matches what other init scripts use.

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 3a488674b5)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-12 15:28:02 +02:00
Peter Korsgaard
593c050f4d package/liburiparser: security bump to version 1.0.1
Fixes the following vulnerability:

CVE-2026-42371: integer overflow in text range comparison
https://github.com/uriparser/uriparser/pull/298

For details, see the announcement:
https://www.openwall.com/lists/oss-security/2026/04/27/2

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit a8e7f79241)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-12 15:21:19 +02:00
Bernd Kuhls
226f163aa0 package/lcms2: security bump version to 2.19
https://littlecms.com/blog/2026/04/17/lcms2-2.19/
https://github.com/mm2/Little-CMS/blob/lcms2.19/ChangeLog

Fixes CVE-2026-41254:
https://security-tracker.debian.org/tracker/CVE-2026-41254

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit c409050184)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-12 15:18:15 +02:00
Fiona Klute
b0efb8c15e package/network-manager: drop obsolete dependency on host-intltool
NetworkManager stopped requiring intltool with 1.40:
56b51b98fb/NEWS (L434)

Fixes: e7c20ad548

host-gettext is already an indirect dependency via package/libglib2.

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
[Marcus: add reference to commit that updated NM to 1.40]
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit c393060c7e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-12 15:13:31 +02:00
Fiona Klute
712e2e8f7c package/python3/Config.in.host: remove select on BR2_PACKAGE_HOST_OPENSSL
There is no such option, and according to the commit history never
was. If BR2_PACKAGE_HOST_PYTHON3_SSL=y the build adds host-openssl to
HOST_PYTHON3_DEPENDENCIES directly.

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit 201d6f4937)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-05-12 15:11:24 +02:00
Bernd Kuhls
e79faf42b6 package/sudo: bump version to 1.9.17p2
https://github.com/sudo-project/sudo/blob/v1.9.17p2/NEWS

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d96eb2f7da)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 14:11:11 +02:00
Bernd Kuhls
ce727d0f75 package/libpng: bump to version 1.6.58
https://github.com/pnggroup/libpng/blob/v1.6.58/ANNOUNCE
"Fixed a regression introduced in version 1.6.56 [...]"

A backport to LTS branches should be considered.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit bc73ca37ef)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 14:10:54 +02:00
Bernd Kuhls
72be078729 package/libxml2: security bump version to 2.15.3
https://download.gnome.org/sources/libxml2/2.15/libxml2-2.15.3.news

- parser: Pass userData to SAX text callbacks in xmlParseReference (type-confusion)
- entities: copy children in xmlCopyEntity
- c14n: Fix Type confusion in xmlC14NProcessAttrsAxis
- python: Do not decref string after adding to the list (double-free / use-after-free)
- c14n: Reuse tmp_str, xmlStrcat reallocates *cur (double-free)

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit c1a34838b9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 14:10:35 +02:00
Bernd Kuhls
0a6eb13542 package/expat: security bump version to 2.8.0
https://github.com/libexpat/libexpat/blob/R_2_8_0/expat/Changes

Fixes CVE-2026-41080.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit c3dfd775b0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 14:10:18 +02:00
Bernd Kuhls
08cd573f0c package/neon: fix build with zlib
Building this defconfig

BR2_x86_64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_PACKAGE_NEON=y
BR2_PACKAGE_NEON_ZLIB=y

does not build libneon with zlib support, quoting configure log:

  configure: zlib not enabled

although the configure parameter

  --with-zlib=/home/bernd/buildroot/output/host/x86_64-buildroot-linux-gnu/sysroot

was used.

The reason is the addition of "=$(STAGING_DIR)" to --with-zlib which was
added to buildroot in 2008 with commit
cc6562ff83.

The upstream code, which expects only "yes", all other values lead to
the else-condition, is unchanged since 2004:
https://github.com/notroj/neon/blame/0.37.1/macros/neon.m4#L478
so a backport of this patch to LTS branches should be considered.

With this patch the configure log shows:

  checking for zlib.h... yes
  checking for inflate in -lz... yes
  configure: zlib support enabled, using -lz

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 5e917c3a81)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 14:09:44 +02:00
Fiona Klute
295e92b1cb package/ca-certificates: bump to 20260223
Changelog including list of added/removed CAs:
b266ecf6af/debian/changelog

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d7ebed6df0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 14:09:16 +02:00
Bernd Kuhls
d36db25ccc DEVELOPERS: remove Clayton Shotwell, e-mail bounces
<clayton.shotwell@collins.com>: host
    mxb-00105402.gslb.gpphosted.com[67.231.155.145] said: 550 5.1.1 User
    Unknown (in reply to RCPT TO command)

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 6774a1e4c8)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 14:08:58 +02:00
Francois Perrad
1b2573e946 package/ficl: bump to version 3.065
- sources are now hosted on Github
- ficl have its own LICENSE file
- remove one upstreamed patch
- support only static lib
- requires C11

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e7dcf9e5af)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 14:08:49 +02:00
Francois Perrad
9b0cb875ef package/ficl: downgrade to version 3.03
see https://sourceforge.net/p/ficl/news/2025/07/ficl4-is-retiring/

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 20bd902142)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 14:08:28 +02:00
Fiona Klute
f43fdf13c7 package/btrfs-progs: remove unnecessary autoreconf
Commit 1c11f9020a removed the patch
changing configure.ac with the bump to 6.10, so it is no longer
needed.

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 9fd8a1cf49)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 14:08:21 +02:00
Marcus Hoffmann
d97a710167 package/python-django: security bump to 6.0.4
Django 6.0.4 fixes one security issue with severity “moderate”, four
security issues with severity “low”, and several bugs in 6.0.3.

Security issues:
* CVE-2026-3902: ASGI header spoofing via underscore/hyphen conflation
    ASGIRequest normalizes header names following WSGI conventions, mapping
    hyphens to underscores. As a result, even in configurations where
    reverse proxies carefully strip security-sensitive headers named with
    hyphens, such a header could be spoofed by supplying a header named with
    underscores.

    Under WSGI, it is the responsibility of the server or proxy to avoid
    ambiguous mappings. (Django’s runserver was patched in CVE 2015-0219.)
    But under ASGI, there is not the same uniform expectation, even if many
    proxies protect against this under default configuration (including
    nginx via underscores_in_headers off;).

    Headers containing underscores are now ignored by ASGIRequest, matching
    the behavior of Daphne, the reference server for ASGI.

    This issue has severity “low” according to the Django security policy.

* CVE-2026-4277: Privilege abuse in GenericInlineModelAdmin¶

    Add permissions on inline model instances were not validated on
    submission of forged POST data in GenericInlineModelAdmin.

    This issue has severity “low” according to the Django security policy.

* CVE-2026-4292: Privilege abuse in ModelAdmin.list_editable¶

    Admin changelist forms using list_editable incorrectly allowed new
    instances to be created via forged POST data.

    This issue has severity “low” according to the Django security policy.

* CVE-2026-33033: Potential denial-of-service vulnerability in
    MultiPartParser via base64-encoded file upload¶

    When using django.http.multipartparser.MultiPartParser, multipart
    uploads with Content-Transfer-Encoding: base64 that include excessive
    whitespace may trigger repeated memory copying, potentially degrading
    performance.

    This issue has severity “moderate” according to the Django security policy.

* CVE-2026-33034: Potential denial-of-service vulnerability in
    ASGI requests via memory upload limit bypass¶

    ASGI requests with a missing or understated Content-Length header could
    bypass the DATA_UPLOAD_MAX_MEMORY_SIZE limit when reading
    HttpRequest.body, potentially loading an unbounded request body into
    memory and causing service degradation.

    This issue has severity “low” according to the Django security policy.

Bugfixes:
* Fixed a regression in Django 6.0 where alogin() and alogout() did not
  respectively set or clear request.user if it had already been
  materialized (e.g., by sync middleware) (#37017).
* Fixed a regression in Django 6.0 in admin forms where
  RelatedFieldWidgetWrapper incorrectly wrapped all widgets in a
  <fieldset> (#36949).
* Fixed a bug in Django 6.0 where the fields.E348 system check did not
  detect name clashes between model managers and related_names for
  non-self-referential relationships (#36973).

Release Notes:
https://docs.djangoproject.com/en/6.0/releases/6.0.4/

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 60ce218196)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 14:06:29 +02:00
Titouan Christophe
a07b4bb16a package/openvpn: security bump to v2.6.20
See the release notes:
https://github.com/OpenVPN/openvpn/blob/v2.6.20/Changes.rst

This fixes 2 security issues:
- CVE-2026-40215:
    race condition in TLS handshake that could lead to leaking of packet
    data from a previous handshake under specific circumstances
- CVE-2026-35058:
    server ASSERT() on receiving a suitably malformed packet with a valid
    tls-crypt-v2 key

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
(cherry picked from commit 1a4a04fe29)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 14:06:00 +02:00
Adrian Perez de Castro
5578590f1e package/webkitgtk: security bump to 2.52.3
This bumps WebKitGTK to the 2.52 stable series. A welcome change
is the addition of the USE_GSTREAMER CMake option that can be used
as a blanket option to toggle all multimedia support, which matches
exactly the intention behind BR2_PACKAGE_WEBKITGTK_MULTIMEDIA.

Includes fixes (among others) for CVE-2026-20643, CVE-2026-20664,
CVE-2026-20665, CVE-2026-20691, CVE-2026-28857, CVE-2026-28859,
CVE-2026-28861, CVE-2026-28871, CVE-2025-43457, CVE-2025-46299,
CVE-2026-20608, CVE-2026-20635, CVE-2026-20636, CVE-2026-20644,
CVE-2026-20652, and CVE-2026-20676.

Highlights of the 2.52 series:
- https://webkitgtk.org/2026/03/18/webkitgtk-2.52-highlights.html

Release notes:
- https://webkitgtk.org/2026/04/16/webkitgtk2.52.3-released.html
- https://webkitgtk.org/2026/04/13/webkitgtk2.52.2-released.html
- https://webkitgtk.org/2026/03/27/webkitgtk2.52.1-released.html
- https://webkitgtk.org/2026/03/18/webkitgtk2.52.0-released.html
- https://webkitgtk.org/2026/03/12/webkitgtk2.50.6-released.html

Security advisories:
- https://webkitgtk.org/security/WSA-2026-0002.html
- https://webkitgtk.org/security/WSA-2026-0001.html

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 6b1de564d0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 14:01:19 +02:00
Titouan Christophe
f3c3cfd7b1 package/imagemagick: security bump to v7.1.2-19
For change log, see:
https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#712-19---2026-04-12

This fixes a large number of CVEs:
- CVE-2026-28493 (since 7.1.2-16)
- CVE-2026-28494 (since 7.1.2-16)
- CVE-2026-28686 (since 7.1.2-16)
- CVE-2026-28687 (since 7.1.2-16)
- CVE-2026-28688 (since 7.1.2-16)
- CVE-2026-28689 (since 7.1.2-16)
- CVE-2026-28690 (since 7.1.2-16)
- CVE-2026-28691 (since 7.1.2-16)
- CVE-2026-28692 (since 7.1.2-16)
- CVE-2026-28693 (since 7.1.2-16)
- CVE-2026-30883 (since 7.1.2-16)
- CVE-2026-30929 (since 7.1.2-16)
- CVE-2026-30931 (since 7.1.2-16)
- CVE-2026-30935 (since 7.1.2-16)
- CVE-2026-30936 (since 7.1.2-16)
- CVE-2026-30937 (since 7.1.2-16)
- CVE-2026-31853 (since 7.1.2-16)
- CVE-2026-32259 (since 7.1.2-16)
- CVE-2026-32636 (since 7.1.2-17)
- CVE-2026-33535 (since 7.1.2-18)
- CVE-2026-33536 (since 7.1.2-18)
- CVE-2026-33899 (since 7.1.2-19)
- CVE-2026-33900 (since 7.1.2-19)
- CVE-2026-33901 (since 7.1.2-19)
- CVE-2026-33902 (since 7.1.2-19)
- CVE-2026-33905 (since 7.1.2-19)
- CVE-2026-33908 (since 7.1.2-19)
- CVE-2026-34238 (since 7.1.2-19)
- CVE-2026-40169 (since 7.1.2-19)
- CVE-2026-40183 (since 7.1.2-19)
- CVE-2026-40310 (since 7.1.2-19)
- CVE-2026-40311 (since 7.1.2-19)
- CVE-2026-40312 (since 7.1.2-19)

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
[Julien: add link to change log in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 08d0c76171)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 14:01:05 +02:00
Bernd Kuhls
eff9a8c4e2 package/squid: security bump version to 7.5
https://github.com/squid-cache/squid/blob/SQUID_7_5/ChangeLog

Fixes:
https://www.cve.org/CVERecord?id=CVE-2026-32748
https://www.cve.org/CVERecord?id=CVE-2026-33515
https://www.cve.org/CVERecord?id=CVE-2026-33526

Removed patches which are included in this release.

Switched to tarball hash provided by upstream.

Updated license hash due to upstream commit
30a55c0819

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: mark the commit as "security" bump, add CVE links]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 5990674340)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 14:00:01 +02:00
Titouan Christophe
a2c0cd7ec4 package/log4cxx: security bump to v1.7.0
For change log, see:
https://logging.apache.org/log4cxx/1.7.0/changelog.html

This fixes the following vulnerability:
- CVE-2026-40023:
    Apache Log4cxx's XMLLayout
    https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayout.html,
    in versions before 1.7.0, fails to sanitize characters forbidden
    by the  XML 1.0 specification https://www.w3.org/TR/xml/#charsets
    in log messages, NDC, and MDC property keys and values, producing
    invalid XML output. Conforming XML parsers must reject such
    documents with a fatal error, which may cause downstream log
    processing systems to drop or fail to index affected records.
    An attacker who can influence logged data can exploit this
    to suppress individual log records, impairing audit trails and
    detection of malicious activity.  Users are advised to upgrade to
    Apache Log4cxx 1.7.0, which fixes this issue.
    https://www.cve.org/CVERecord?id=CVE-2026-40023

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
[Julien: add link to change log in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 1d5c6d18da)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 13:59:14 +02:00
Julien Olivain
2887dd91cc package/python-magic-wormhole: security bump to version 0.23.0
See NEWS:
https://github.com/magic-wormhole/magic-wormhole/blob/0.23.0/NEWS.md

This commit also updates _SITE to use a stable URL which will redirect
to the package archive, to reduce future maintenance.

Fixes:
https://nvd.nist.gov/vuln/detail/CVE-2026-32116

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit 8de4776c60)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 13:58:27 +02:00
Julien Olivain
6873a1beab package/python-magic-wormhole: add CPE ID
The CPE ID `magic_wormhole_project:magic_wormhole` is valid for
magic-wormhole. See:
https://nvd.nist.gov/products/cpe/detail/591D7832-786D-4BBD-A16A-04CBDE20333B

This commit adds the information.

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit 298390ade4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 13:57:32 +02:00
Bernd Kuhls
94e54141f9 package/libspdm: security bump version to 3.8.2
https://github.com/DMTF/libspdm/releases/tag/3.8.2

This release brings a fix for the security issues described in
https://github.com/DMTF/libspdm/security/advisories/GHSA-j54w-759w-xj3m
https://github.com/DMTF/libspdm/security/advisories/GHSA-m4wc-xmvg-369f

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 80898249b7)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 13:51:28 +02:00
Bernd Kuhls
c835846174 package/ruby: security bump version to 4.0.3
https://www.ruby-lang.org/en/news/2026/04/21/ruby-4-0-3-released/

Added sha512 tarball hash provided by upstream.

Fixes CVE-2026-41316:
https://www.ruby-lang.org/en/news/2026/04/21/erb-cve-2026-41316/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 92746d0dea)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 13:49:49 +02:00
Waldemar Brodkorb
66221b107d package/ruby: bump to 4.0.2
See here for news in the release:
https://www.ruby-lang.org/en/news/2026/03/16/ruby-4-0-2-released/

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 8937414d68)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 13:49:43 +02:00
Fiona Klute
d9e4d86cb0 package/musl: add upstream security patches for CVE-2026-40200
Fixes CVE-2026-40200: musl libc: stack corruption in qsort with
sufficiently large inputs
https://www.openwall.com/lists/musl/2026/04/10/3

Fixes: https://nvd.nist.gov/vuln/detail/CVE-2026-40200

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e96e63dc0e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 13:49:17 +02:00
Fiona Klute
fe306a4df2 package/musl: add upstream security patch for CVE-2026-6042
Fixes CVE-2026-6042: musl libc: Algorithmic complexity DoS in iconv
GB18030 decoder
https://www.openwall.com/lists/oss-security/2026/04/09/19

Fixes: https://nvd.nist.gov/vuln/detail/CVE-2026-6042

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit b5ff02164f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 13:48:27 +02:00
Thomas Perale
b9ff9c9957 package/mbedtls: security bump to v3.6.6
For more information about the release, see:

- https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-3.6.6
- https://github.com/Mbed-TLS/mbedtls/compare/mbedtls-3.6.5..mbedtls-3.6.6

Fixes the following vulnerabilities:

- CVE-2025-66442
    In Mbed TLS through 4.0.0, there is a compiler-induced timing side
    channel (in RSA and CBC/ECB decryption) that only occurs with LLVM's
    select-optimize feature. TF-PSA-Crypto through 1.0.0 is also affected.

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2025-66442
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-compiler-induced-constant-time-violations/

- CVE-2026-25833:
    Mbed TLS 3.5.0 to 3.6.5 fixed in 3.6.6 and 4.1.0 has a buffer overflow
    in the x509_inet_pton_ipv6() function

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-25833
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-inet-pton/

- CVE-2026-25834:
    Mbed TLS v3.3.0 up to 3.6.5 and 4.0.0 allows Algorithm Downgrade.

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-25834
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-sigalg-injection/

- CVE-2026-25835:
    Mbed TLS before 3.6.6 and TF-PSA-Crypto before 1.1.0 misuse seeds in a
    Pseudo-Random Number Generator (PRNG).

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-25835
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-rng-cloning/

- CVE-2026-34871:
    An issue was discovered in Mbed TLS before 3.6.6 and 4.x before 4.1.0
    and TF-PSA-Crypto before 1.1.0. There is a Predictable Seed in a
    Pseudo-Random Number Generator (PRNG).

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-34871
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-dev-random/

- CVE-2026-34872:
    An issue was discovered in Mbed TLS 3.5.x and 3.6.x through 3.6.5 and
    TF-PSA-Crypto 1.0. There is a lack of contributory behavior in FFDH
    due to improper input validation. Using finite-field Diffie-Hellman,
    the other party can force the shared secret into a small set of values
    (lack of contributory behavior). This is a problem for protocols that
    depend on contributory behavior (which is not the case for TLS). The
    attack can be carried by the peer, or depending on the protocol by an
    active network attacker (person in the middle).

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-34872
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-ffdh-peerkey-checks/

- CVE-2026-34873:
    An issue was discovered in Mbed TLS 3.5.0 through 4.0.0. Client
    impersonation can occur while resuming a TLS 1.3 session.

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-34873
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-client-impersonation-while-resuming-tls13-session/

- CVE-2026-34874:
    An issue was discovered in Mbed TLS through 3.6.5 and 4.x through
    4.0.0. There is a NULL pointer dereference in distinguished name
    parsing that allows an attacker to write to address 0.

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-34874
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-null-pointer-dereference-x509/

- CVE-2026-34875:
    An issue was discovered in Mbed TLS through 3.6.5 and TF-PSA-Crypto
    1.0.0. A buffer overflow can occur in public key export for FFDH keys.

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-34875
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-ffdh-buffer-overflow/

- CVE-2026-34876:
    An issue was discovered in Mbed TLS 3.x before 3.6.6. An out-of-bounds
    read vulnerability in mbedtls_ccm_finish() in library/ccm.c allows
    attackers to obtain adjacent CCM context data via invocation of the
    multipart CCM API with an oversized tag_len parameter. This is caused
    by missing validation of the tag_len parameter against the size of the
    internal 16-byte authentication buffer. The issue affects the public
    multipart CCM API in Mbed TLS 3.x, where mbedtls_ccm_finish() can be
    invoked directly by applications. In Mbed TLS 4.x versions prior to
    the fix, the same missing validation exists in the internal
    implementation; however, the function is not exposed as part of the
    public API. Exploitation requires application-level invocation of the
    multipart CCM API.

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-34876
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-ccm-finish-boundary-check/

- CVE-2026-34877:
    An issue was discovered in Mbed TLS versions from 2.19.0 up to 3.6.5,
    Mbed TLS 4.0.0. Insufficient protection of serialized SSL context or
    session structures allows an attacker who can modify the serialized
    structures to induce memory corruption, leading to arbitrary code
    execution. This is caused by Incorrect Use of Privileged APIs.

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-34877
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-serialized-data/

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e1c7f198dc)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 13:48:11 +02:00
Thomas Perale
9678db2cc5 package/cups: security bump to v2.4.17
For more information about the release, see:

- https://github.com/OpenPrinting/cups/releases/tag/v2.4.17
- https://github.com/OpenPrinting/cups/blob/2.4.x/CHANGES.md

The new release 2.4.17 contains the following security fixes:

- CVE-2026-27447: The scheduler treated local user and group names as
  case-insensitive.
  https://www.cve.org/CVERecord?id=CVE-2026-27447

- CVE-2026-34978: The RSS notifier could write outside the scheduler's
  RSS directory.
  https://www.cve.org/CVERecord?id=CVE-2026-34978

- CVE-2026-34979: The scheduler did not always allocate enough memory
  for a job's options string.
  https://www.cve.org/CVERecord?id=CVE-2026-34979

- CVE-2026-34980: The scheduler did not filter control characters from
  option values.
  https://www.cve.org/CVERecord?id=CVE-2026-34980

- CVE-2026-34990: The scheduler incorrectly allowed local certificates
  over the loopback interface.
  https://www.cve.org/CVERecord?id=CVE-2026-34990

- CVE-2026-39314: Fixed the range check for job password strings.
  https://www.cve.org/CVERecord?id=CVE-2026-39314

- CVE-2026-39316: Fixed a printer subscription bug in the scheduler.
  https://www.cve.org/CVERecord?id=CVE-2026-39316

- CVE-2026-41079: Fixed a SNMP string conversion bug in the backends.
  https://www.cve.org/CVERecord?id=CVE-2026-41079

Also updated patch offsets.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 1f801dc616)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 13:47:54 +02:00
Bernd Kuhls
e396852da5 package/libpjsip: security bump version to 2.16
https://github.com/pjsip/pjproject/releases/tag/2.16

Fixes CVE-2025-65102:
https://github.com/pjsip/pjproject/security/advisories/GHSA-w5vr-39x7-h8g5

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit a266be923f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 13:47:36 +02:00
Bernd Kuhls
1c6afcd9f1 package/p11-kit: security bump version to 0.26.2
https://github.com/p11-glue/p11-kit/blob/0.26.2/NEWS

Fixes CVE-2026-2100: https://github.com/advisories/GHSA-hq85-3f6c-jx84

Switched to sha256 tarball hash provided by upstream.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit a5366d13ba)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 13:44:35 +02:00
Marcus Hoffmann
6b2ec19340 package/util-linux: security bump to 2.41.4
Security fixes:

 CVE-2026-27456 - mount(8) TOCTOU symlink attack via loop device.
   The SUID mount follows symlinks when resolving loop backing file
   paths. On systems where non-root users are permitted to mount loop
   devices (via 'user' option in fstab), this allows access to
   arbitrary files.

 CWE-190 - Integer overflow in libblkid parse_dos_extended().
   A crafted MBR disk image can cause uint32_t wraparound in EBR
   chain processing, causing reported partitions to not match the
   on-disk layout. Tools like udisks may then register a partition
   at logical sector 0.

Full release notes: https://www.kernel.org/pub/linux/utils/util-linux/v2.41/v2.41.4-ReleaseNotes

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit cd52acda14)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-30 13:41:23 +02:00
Titouan Christophe
152acddfa7 {linux, linux-headers}: bump 6.12.x, 6.6.x, 6.19.x, 6.18.x series
Update the latest kernel releases to:
 - 6.12.82 -> 6.12.84
 - 6.6.135 -> 6.6.136
 - 6.19.13 -> 6.19.14
 - 6.18.23 -> 6.18.25

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2026-04-29 15:24:44 +02:00
Titouan Christophe
0be927b89a package/systemd: security bump to v258.7
This fixes the following vulnerabilities:

- CVE-2026-29111 (fixed in 258.5):
    systemd, a system and service manager, (as PID 1) hits an assert and
    freezes execution when an unprivileged IPC API call is made with
    spurious data. On version v249 and older the effect is not an assert,
    but stack overwriting, with the attacker controlled content. From
    version v250 and newer this is not possible as the safety check causes
    an assert instead. This IPC call was added in v239, so versions older
    than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11
    contain patches. No known workarounds are available.
    https://www.cve.org/CVERecord?id=CVE-2026-29111

- CVE-2026-40226 (fixed in 258.6):
    In nspawn in systemd 233 through 259 before 260, an escape-to-host
    action can occur via a crafted optional config file.
    https://www.cve.org/CVERecord?id=CVE-2026-40226
    https://github.com/systemd/systemd/security/advisories/GHSA-9mj4-rrc3-gjcx

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
[Marcus: note which minor versions included the respective security fixes]
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit f6e0ad3858)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-23 14:33:50 +02:00
Shubham Chakraborty
8fd2727270 DEVELOPERS: add Shubham Chakraborty as pv maintainer
Signed-off-by: Shubham Chakraborty <chakrabortyshubham66@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit bf7c35d4f7)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-23 14:33:04 +02:00
Julien Olivain
2b6eab392d package/mkpasswd: add dependency to host-libxcrypt
The host-mkpasswd package needs the <crypt.h> header file installed
on the host. This file was initially provided by the libc headers,
as part of its libcrypt implementation. libcrypt was removed in
glibc 2.39. Most Linux distributions continued to ship a libcrypt
replacement such as libxcrypt in their default installation.

Some mainstream Linux distribution (such as Debian testing) are
now starting to remove this libcrypt and <crypt.h> header from their
default image (of development files).

In that case, host-mkpasswd is failing to build with the error:

    /buildroot/output/build/host-mkpasswd/mkpasswd.c:54:10: fatal error: crypt.h: No such file or directory

The issue can be reproduced by adapting the Buildroot Docker file,
by setting "FROM debian:testing-20260316" in [1] and removing
the build of tar.

Note: debian 13 (for example Docker tag trixie-20260316) still
includes the libcrypt-dev package by default, which provides crypt.h.

In Buildroot, there is already the host-heimdal and host-systemd
packages requiring host-libxcrypt. Also, the host-libxcrypt is a
small standalone package. For those reasons, instead of adding
the Buildroot prerequisite on the user host to provide a libcrypt
implementation, this commit simply add the package dependency to
host-libxcrypt, to make sure it will work in all situations.

[1] https://gitlab.com/buildroot.org/buildroot/-/blob/2026.02/support/docker/Dockerfile#L11

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit cf26c77280)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-23 14:31:48 +02:00
Julien Olivain
cc627f2c67 package/libjxl: security bump to version 0.11.2
For release notes since v0.11.1, see:
https://github.com/libjxl/libjxl/releases/tag/v0.11.2

Fixes:
https://www.cve.org/cverecord?id=CVE-2025-12474
https://www.cve.org/cverecord?id=CVE-2026-1837

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit ccf69ab8c4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-23 14:30:11 +02:00
Titouan Christophe
e4b3bdb663 package/dash: add patch for CVE-2026-31323
The vulnerability description is not disclosed yet.

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
(cherry picked from commit 7e24f892f6)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-23 14:29:25 +02:00
Bernd Kuhls
7a1f92b0df package/libmicrohttpd: security bump version to 1.0.5
https://lists.gnu.org/archive/html/libmicrohttpd/2026-04/msg00003.html

Fixes CWE-444: https://cwe.mitre.org/data/definitions/444.html

Version 1.0.4 contains a bug and was never officially announced:
https://lists.gnu.org/archive/html/libmicrohttpd/2026-04/msg00002.html

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 712121326f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-23 14:26:56 +02:00
Bernd Kuhls
e898ab668f package/ghostscript: security bump to version 10.07.0
https://ghostscript.readthedocs.io/en/gs10.07.0/News.html
"This release addresses CVEs: TBC (Two applied for)"

Removed patch which is included in this release.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 6216be221f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-23 14:26:25 +02:00
Bernd Kuhls
7c9a398eba package/ghostscript: Fix brotli build failure on ARMv7
Fixes:
https://autobuild.buildroot.net/results/9e3/9e3435752d50ed3db55b0ff03e412bf42728f73a/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 2965d8af98)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-23 14:25:38 +02:00
Adrian Perez de Castro
67692112f7 package/xdg-dbus-proxy: security bump to version 0.1.7
While there is not a security advisory to go with the release,
it includes a patch to prevent message interception that may be
considered a security fix.

Release notes:

  https://github.com/flatpak/xdg-dbus-proxy/releases/tag/0.1.7

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 188fad7af1)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-23 14:25:15 +02:00
Bernd Kuhls
3082413b9b package/libarchive: security bump version to 3.8.7
https://github.com/libarchive/libarchive/releases/tag/v3.8.7
"Libarchive 3.8.7 is a security and bugfix release."

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 5fc186771e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-23 14:24:12 +02:00
Bernd Kuhls
2513ab9603 package/libexif: security bump to version 0.6.26
https://github.com/libexif/libexif/blob/v0.6.26/NEWS

* Security issues fixed:
  * CVE-2026-40386: An unsigned integer underflow in Fuji and Olympus
    makernote handling
  * CVE-2026-40385: An unsigned integer overflow on 32bit systems in
    Nikon makernote handling
  * CVE-2026-32775: A buffer overwrite via integer underflow in makernote
    handling

Switched to xz tarball and tarball hash provided by upstream.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 3f9bcf42c3)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-23 14:23:43 +02:00
Marcus Hoffmann
2e3c080b98 package/bat: remove no longer needed patch for gcc15 compat
The bat 0.26.0 already depends on a newer version of the onig_sys crate,
so the problem that patch is fixing was no already no longer present.

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 0e2b7e2bee)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-23 14:23:09 +02:00
Bernd Kuhls
d1c44f8cdf package/wolfssl: security bump version to 5.9.1
https://github.com/wolfSSL/wolfssl/blob/v5.9.1-stable/ChangeLog.md

Restored patch 0001 to its original state.

Updated license hashes due to upstream commits:

"updating license from GPLv2 to GPLv3"
629c5b4cf6

"Add GPLv2 exception list to LICENSING"
e02de78507

with various follow-up commits:
0d49df7735
32d33f2a53
1e9d71af42
18332faa05

Fixes the following CVEs:

* [High] CVE-2026-5264
* [High] CVE-2026-5263
* [High] CVE-2026-5295
* [High] CVE-2026-5466
* [High] CVE-2026-5477
* [High] CVE-2026-5447
* [High] CVE-2026-5500
* [High] CVE-2026-5501
* [High] CVE-2026-5503
* [Low] CVE-2026-5187
* [Low] CVE-2026-5188
* [Low] CVE-2026-5448
* [Low] CVE-2026-5772
* [Low] CVE-2026-5778
* [High] CVE-2026-3548
* [High] CVE-2026-3549
* [High] CVE-2026-3547
* [Low] CVE-2026-0819
* [Low] CVE-2026-1005
* [Low] CVE-2026-2645
* [Low] CVE-2026-3230
* [Low] CVE-2025-12888
* [Med.] CVE-2025-11936
* [Low] CVE-2025-11935
* [Low] CVE-2025-11934
* [Low] CVE-2025-11933
* [Low] CVE-2025-11931
* [Low] CVE-2025-11932
* [Low] CVE-2025-12889
* [Low] CVE-2025-13912
* [High] CVE-2025-7395
* [Med.] CVE-2025-7394
* [Low] CVE-2025-7396

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 99f8ed1212)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-23 14:22:47 +02:00
Bernd Kuhls
fadcabd086 package/wolfssl: fix build with libcurl >= 8.19.0
wolfssl requires definition of SIZEOF_LONG_LONG. Commit 3a5e071e4f
("package/libcurl: security bump to version 8.19.0") removed
SIZEOF_LONG_LONG definitions from libcurl autotools build system,
breaking build with wolfssl.

Fixes:
https://autobuild.buildroot.net/results/baa/baa74a47464ed3e21d0adad64dd0c7c708c9ef85/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 50feb87384)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-23 14:22:25 +02:00
Bernd Kuhls
b6474fc1c4 package/wolftpm: security bump version to 3.10.0
https://github.com/wolfSSL/wolfTPM/blob/v3.10.0/ChangeLog.md

Version 3.9.2 fixes CVE-2025-7844:
https://github.com/wolfSSL/wolfTPM/pull/427

Upstream switched from GPL-2.0+ to GPL-3.0+ with version 3.9.2:
1402d0d132

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 482a8e61fa)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-23 14:22:00 +02:00
Bernd Kuhls
ceb27f0f04 package/strongswan: security bump version to 6.0.5
https://github.com/strongswan/strongswan/releases/tag/6.0.5

Switched _SITE to https.

Fixes CVE-2026-25075.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit cc7c20d817)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-23 14:19:32 +02:00
Bernd Kuhls
64e67580da package/strongswan: remove unneeded wolfSSL fix
Using this defconfig

BR2_x86_64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_PER_PACKAGE_DIRECTORIES=y
BR2_PACKAGE_STRONGSWAN=y
BR2_PACKAGE_STRONGSWAN_WOLFSSL=y

applied after 'git reset 10a70b1af6 --hard'

replicates the build error
http://autobuild.buildroot.net/results/278b3f74c48c858ae368d59069752adb69c05246

which was fixed in 2024 by
89d512729c

Note: The git tree was reset to the commit right before the fix.

Instead of using the fix mentioned above the build error is also fixed
when the buildroot commit 6c18375434 is
cherry-picked onto 10a70b1af6.

This means the build error mentioned above is really fixed by enabling
BR2_PACKAGE_WOLFSSL_ALL. Therefore we can remove the content of commit
89d512729c.

This commit also prevents a build error in strongswan

wolfssl_rsa_private_key.c: In function 'create_empty':
wolfssl_rsa_private_key.c:450:18: error: 'RsaKey' has no member named 'rng'
  450 |         this->rsa.rng = &this->rng;

caused by the upcoming bump of wolfSSL from 5.7.2 to 5.9.1 due to
upstream commit
cd88a8ae88
which was first included in wolfSSL 5.9.0.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 5d6378db9d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-23 14:19:21 +02:00
Bernd Kuhls
460d0ebf95 package/x11r7/xwayland: security bump version to 24.1.10
https://lists.x.org/archives/xorg-announce/2026-April/003679.html

Updated license hash due to upstream commits:
e5c6a5ab90
89f82cce4a

Fixes the following CVEs:

* CVE-2026-33999: XKB Integer Underflow in XkbSetCompatMap()
* CVE-2026-34000: XKB Out-of-bounds Read in CheckSetGeom()
* CVE-2026-34001: XSYNC Use-after-free in miSyncTriggerFence()
* CVE-2026-34002: XKB Out-of-bounds read in CheckModifierMap()
* CVE-2026-34003: XKB Buffer overflow in CheckKeyTypes()

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 40f8603e6a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-23 14:16:36 +02:00
Bernd Kuhls
ed0266aa51 package/x11r7/xserver_xorg-server: security bump version to 21.1.22
https://lists.x.org/archives/xorg-announce/2026-April/003678.html

Updated license hash due to upstream commits:
3069f64d69
dd924b160c

Fixes the following CVEs:

* CVE-2026-33999: XKB Integer Underflow in XkbSetCompatMap()
* CVE-2026-34000: XKB Out-of-bounds Read in CheckSetGeom()
* CVE-2026-34001: XSYNC Use-after-free in miSyncTriggerFence()
* CVE-2026-34002: XKB Out-of-bounds read in CheckModifierMap()
* CVE-2026-34003: XKB Buffer overflow in CheckKeyTypes()

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 0136eba110)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-23 14:13:08 +02:00
Bernd Kuhls
66a249753e package/c-icap: fix musl build
Fixes:
https://autobuild.buildroot.net/results/33b/33bb3ea8ac36da7f40a82c580d3614f0b34a7ab2/

The oldest build error dates back to June 2024 so this patch should be
backported to LTS branches.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 428e0e292b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-23 14:10:48 +02:00
Titouan Christophe
b79ab7b812 {linux, linux-headers}: bump 6.12.x, 6.6.x, 6.1.x, 5.15.x, 5.10.x, 6.19.x, 6.18.x series
Update the latest kernel releases to:
 - 6.12.81 -> 6.12.82
 - 6.6.134 -> 6.6.135
 - 6.1.168 -> 6.1.169
 - 5.15.202 -> 5.15.203
 - 5.10.252 -> 5.10.253
 - 6.19.12 -> 6.19.13
 - 6.18.22 -> 6.18.23

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2026-04-23 13:48:25 +02:00
Arnout Vandecappelle
0141ca3fa5 Makefile: Update for 2026.02.1
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2026-04-21 23:03:56 +02:00
Arnout Vandecappelle
b1cb4bc509 CHANGES: Update for 2026.02.1
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2026-04-21 20:26:13 +02:00
Bernd Kuhls
d04c454ac3 package/libopenssl: security bump to version 3.6.2
https://openssl-library.org/post/2026-04-07-release-announcement/

Fixes the following vulnerabilities:

CVE-2026-31790 - Incorrect Failure Handling in RSA KEM RSASVE Encapsulation.
CVE-2026-28386 - Out-of-bounds Read in AES-CFB-128 on X86-64 with AVX-512 Support.
CVE-2026-28387 - Potential Use-after-free in DANE Client Code.
CVE-2026-28388 - NULL Pointer Dereference When Processing a Delta CRL.
CVE-2026-28389 - Possible NULL Dereference When Processing CMS KeyAgreeRecipientInfo.
CVE-2026-28390 - Possible NULL Dereference When Processing CMS KeyTransportRecipientInfo.
CVE-2026-31789 - Heap Buffer Overflow in Hexadecimal Conversion.

Removed patch 0004 which is included in this release, merged in:
7936b4c415

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 58d2330b62)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-17 18:17:03 +02:00
Bernd Kuhls
e40a802ba3 package/php: bump version to 8.5.5
https://www.php.net/ChangeLog-8.php#8.5.5
https://news-web.php.net/php.announce/488

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 1014d8ffb6)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-17 17:21:31 +02:00
Marcus Hoffmann
67f7393f1b package/python-gpiod: security bump to 2.4.2
Update for libgpiod v2.2.4.
Contains the following security fix:
https://git.kernel.org/pub/scm/libs/libgpiod/libgpiod.git/commit/?h=python-v2.4.x&id=c3655b5f641b87656c11da3ac708608d2c0e05ee

The package now contains a proper LICENSE file in the sdist since:
https://git.kernel.org/pub/scm/libs/libgpiod/libgpiod.git/commit/?h=python-v2.4.x&id=51ee19fe1ec8a94b5ecfdc7627b0c574c7874a1b

Note: this commit is marked as "security" update because it contains
security related bugfixes, but no CVE or advisory are published at
the time of this commit.

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
[Julien: add note in the commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 8b965c2665)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-17 17:21:29 +02:00
Marcus Hoffmann
6b8cb03a4a package/libgpiod2: security bump to 2.2.4
Bug fixes:
- fix buffer over-read bugs when translating uAPI structs to library types
- fix variable and argument types where necessary
- sanitize values returned by the kernel to avoid potential buffer overflows
- fix memory leaks in gpio-tools
- add missing return value checks in gpio-tools
- fix period parsing in gpio-tools
- use correct loop counter in error path in gpio-manager

Improvements:
- make tests work with newer coreutils by removing cases checking tools'
  behavior on SIGINT which stopped working due to changes in behavior of the
  timeout tool

See: https://git.kernel.org/pub/scm/libs/libgpiod/libgpiod.git/tree/NEWS?h=v2.2.4

Note: this commit is marked as "security" update because it contains
security related bugfixes, but no CVE or advisory are published at
the time of this commit.

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
[Julien: add note in the commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 6ac53518a0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-17 17:21:27 +02:00
Michael Nosthoff
60748b81af package/libgpiod2: bump to version 2.2.3
Changelog:
https://git.kernel.org/pub/scm/libs/libgpiod/libgpiod.git/tree/NEWS?h=v2.2.3

Signed-off-by: Michael Nosthoff <buildroot@heine.tech>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit 1afd1a6d4d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-17 17:21:25 +02:00
Gary Bisson
fc52ce0ef6 configs/nitrogen*: switch to bootlin toolchain
As recommended by Julien[1].

[1] https://lists.buildroot.org/pipermail/buildroot/2026-April/800059.html

Signed-off-by: Gary Bisson <bisson.gary@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 8c655ac80c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-17 17:21:23 +02:00
Giulio Benetti
d7da44f6da package/wireshark: security bump to v4.4.14
For more information on the version bump, see:
  - https://www.wireshark.org/docs/relnotes/wireshark-4.4.14.html

Fixes the following vulnerabilities:

- CVE-2026-3201:
    USB HID dissector memory exhaustion in Wireshark 4.4.0 to 4.4.13 and 4.6.0 to
    4.6.3 allows denial of service

    https://www.cve.org/CVERecord?id=CVE-2026-3201

- CVE-2026-3203:
    RF4CE Profile dissector crash in Wireshark 4.4.0 to 4.4.13 and 4.6.0 to
    4.6.3 allows denial of service

    https://www.cve.org/CVERecord?id=CVE-2026-3203

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit 9639bb44c7)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-17 17:21:21 +02:00
Yegor Yefremov
930b6d3930 package/libftdi1: enable static only build
libfdti1 provides configuration options SHAREDLIBS and STATICLIBS
that allow any combination of static/shared libraries.

Fixes:
https://autobuild.buildroot.org/results/d7b9a45ccffc1c9e3fd796c3e46ee396b7d88272/

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
[Marcus: explicitly check for BR2_SHARED_STATIC_LIBS]
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit 0a9b365de4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-17 17:21:19 +02:00
Christian Stewart
1b5a7bb021 package/go: security bump to version 1.26.2
go1.26.2 (released 2026-04-07) includes security fixes to the go command, the
compiler, and the archive/tar, crypto/tls, crypto/x509, html/template, and os
packages, as well as bug fixes to the go command, the go fix command, the
compiler, the linker, the runtime, and the net, net/http, and net/url packages.

CVE-2026-32289: html/template: JS template literal context incorrectly tracked
CVE-2026-33810: crypto/x509: excluded DNS constraints not properly applied to wildcard domains
CVE-2026-27144: cmd/compile: no-op interface conversion bypasses overlap checking
CVE-2026-27143: cmd/compile: possible memory corruption after bound check elimination
CVE-2026-32288: archive/tar: unbounded allocation when parsing old format GNU sparse map
CVE-2026-32283: crypto/tls: multiple key update handshake messages can cause connection to deadlock
CVE-2026-27140: cmd/go: trust layer bypass when using cgo and SWIG
CVE-2026-32280: crypto/x509: unexpected work during chain building
CVE-2026-32281: crypto/x509: inefficient policy validation

https://go.dev/doc/devel/release#go1.26.2
https://github.com/golang/go/issues?q=milestone%3AGo1.26.2+label%3ACherryPickApproved

Signed-off-by: Christian Stewart <christian@aperture.us>
[Julien: add "security" in commit log title]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 82518f8cb4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-17 17:21:17 +02:00
Titouan Christophe
fc8111fcd1 package/redis: security bump to v8.4.2
See the release notes:
https://github.com/redis/redis/blob/8.4.2/00-RELEASENOTES

================================================================================
Redis 8.4.2    Released Mon 23 Feb 2026 10:00:00 IST
================================================================================

SECURITY: There is a security fix in the release

- A user can manipulate data read by a connection by injecting \r\n sequences
  into a Redis error reply

================================================================================
Redis 8.4.1    Released Sun 8 Feb 2026 9:00:00 IST
================================================================================

Update urgency: `SECURITY`: There are security fixes in the release.

- #T1837, #J1474 Hide Personally Identifiable Information from server log
- #P936 Cuckoo filter: crash on RDB load on 0 buckets (MOD-11593)
- #P945 Bloom filter: crash on RDB load on large number of filters (MOD-11590)

(And a whole lot of other bugfixes)

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 29a4927157)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-17 17:21:15 +02:00
Bernd Kuhls
f7ea0c8aa0 package/libcap: security bump version to 2.78
Release notes:
https://sites.google.com/site/fullycapable/release-notes-for-libcap#h.x4zn8j3lss6r

Removed patch which is included in this release.

Fixes CVE-2026-4878.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 76e4d8e3df)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-17 17:21:13 +02:00
Bernd Kuhls
e96084eb61 package/python3: security bump version to 3.14.4
https://www.python.org/downloads/release/python-3144/
https://docs.python.org/release/3.14.4/whatsnew/changelog.html

Fixes
CVE 2026-4224: https://www.cve.org/CVERecord?id=CVE-2026-4224
CVE 2026-3644: https://www.cve.org/CVERecord?id=CVE-2026-3644
CVE 2026-2297: https://www.cve.org/CVERecord?id=CVE-2026-2297

Rebased patch 0010 due to upstream commit
616e611844

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f862711b10)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-17 17:21:11 +02:00
Bernd Kuhls
a9d1714fb2 package/libpng: security bump to version 1.6.57
https://github.com/pnggroup/libpng/blob/v1.6.57/ANNOUNCE

Fixes CVE-2026-34757:
https://github.com/pnggroup/libpng/security/advisories/GHSA-6fr7-g8h7-v645

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit ad5faa474c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-17 17:21:10 +02:00
Michael Nosthoff
e714e38a87 package/libglib2: security bump to version 2.86.5
Fix several security vulnerabilities of varying severity.

Release Notes:
https://gitlab.gnome.org/GNOME/glib/-/releases/2.86.3
https://gitlab.gnome.org/GNOME/glib/-/releases/2.86.4
https://gitlab.gnome.org/GNOME/glib/-/releases/2.86.5

Fixes:
- CVE-2025-13601
- CVE-2026-1484
- CVE-2026-1485
- CVE-2026-1489

Signed-off-by: Michael Nosthoff <buildroot@heine.tech>
[Julien:
 - fix URL in hash file comment
 - add "security" in commit log title
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit b9ea86b26a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-17 17:21:08 +02:00
Bernd Kuhls
d29bfbd6a3 package/libde265: security bump version to 1.0.18
https://github.com/strukturag/libde265/releases/tag/v1.0.18

https://github.com/strukturag/libde265/releases/tag/v1.0.17
Fixes CVE-2026-33164 & CVE-2026-33165.

Used sha256 tarball hash provided by upstream.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d4b8a42fb2)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-17 17:21:06 +02:00
Julien Olivain
bbfbabcc50 arch: mark a set of target configurations as secondary
Those target configurations marked as "secondary" will be tested with a
lower probability in autobuilders. The intent is to focus the Buildroot
development (and bugfixes) on mainstream configurations, while still
keeping some other, less common, configurations.

This commit marks the following CPU architectures as secondary:

BR2_arcle (ARC little endian)
BR2_armeb (ARM big endian)
BR2_aarch64_be (AArch64 big endian)
BR2_hppa (PA-RISC)
BR2_loongarch64
BR2_m68k
BR2_microblazeel (Microblaze AXI, little endian)
BR2_microblazebe (Microblaze non-AXI, big endian)
BR2_mips (MIPS, big endian)
BR2_mipsel (MIPS, little endian)
BR2_mips64 (MIPS64 big endian)
BR2_or1k (OpenRISC)
BR2_powerpc (PowerPC, big endian)
BR2_powerpc64 (PowerPC64, big endian)
BR2_s390x
BR2_sh (SuperH)
BR2_sparc
BR2_sparc64
BR2_xtensa

In the following CPU architecture, only specific configurations are
marked secondary:

In BR2_armeb (ARM little endian),
- armv4 cores (arm920t, arm922t, fa526/626, strongarm sa110/sa1100)

In BR2_riscv:
- all 32-bit configurations
- 64-bit no-MMU

In BR2_i386 (x86 32-bit),
- i486, i586 and X1000 CPU

There was no strict rule established to build this list of secondary
configurations. This list was built mainly from the observation of
which architecture/CPUs are still widely used in the field
(disregarding its age), the quality of their upstream support and
the general relevance in the Buildroot project.

Signed-off-by: Julien Olivain <ju.o@free.fr>
[Arnout: use !BR2_HIDE_SECONDARY_TARGET_OPTIONS instead of
BR2_SHOW_SECONDARY_TARGET_OPTIONS]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit ddce0814a7)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-17 17:21:04 +02:00
Julien Olivain
bf5c58e0d3 Config.in, Makefile: add BR2_HIDE_SECONDARY_TARGET_OPTIONS
The option is currently unused, which leads to a check-symbol warning.

Suggested-by: Arnout Vandecappelle <arnout@rnout.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
[Arnout: squash two patches]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 4642f903cd)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-17 17:21:02 +02:00
Francois Perrad
2512acc862 package/quickjs: security bump to version 2025-09-13
fixes this serie of CVE:
https://security-tracker.debian.org/tracker/CVE-2025-62490
https://security-tracker.debian.org/tracker/CVE-2025-62491
https://security-tracker.debian.org/tracker/CVE-2025-62492
https://security-tracker.debian.org/tracker/CVE-2025-62493
https://security-tracker.debian.org/tracker/CVE-2025-62494
https://security-tracker.debian.org/tracker/CVE-2025-62495
https://security-tracker.debian.org/tracker/CVE-2025-62496

For release notes, see:
https://bellard.org/quickjs/Changelog

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit ac4c32f6f8)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-17 17:21:00 +02:00
Bernd Kuhls
39ca2c22b2 package/libmicrohttpd: security bump version to 1.0.3
https://lists.gnu.org/archive/html/info-gnu/2026-04/msg00000.html

Fixes the following vulnerabilities:

- CVE-2025-59777

See https://nvd.nist.gov/vuln/detail/CVE-2025-59777

- CVE-2025-62689

See https://nvd.nist.gov/vuln/detail/CVE-2025-62689

Switched project URL to https.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 8218689810)
[thomas: added security mention]
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-17 17:20:58 +02:00
Titouan Christophe
d86dc1a48e {linux, linux-headers}: bump 6.12.x, 6.6.x, 6.1.x, 6.19.x, 6.18.x series
Update the latest kernel releases to:
 - 6.12.79 -> 6.12.81
 - 6.6.130 -> 6.6.134
 - 6.1.167 -> 6.1.168
 - 6.19.10 -> 6.19.12
 - 6.18.20 -> 6.18.22

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2026-04-17 17:20:56 +02:00
Bernd Kuhls
7cd8b4791d package/xz: security bump version to 5.8.3
https://github.com/tukaani-project/xz/releases/tag/v5.8.3

Fixes CVE-2026-34743.

Switched to sha256 tarball provided by upstream.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 7246352273)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-15 08:17:44 +02:00
Bernd Kuhls
a3ef297e0e package/xz: bump version to 5.8.2
https://github.com/tukaani-project/xz/releases/tag/v5.8.2
"- Fix the build on ARM64 on glibc versions older than
   2.24 (2016). They don't have HWCAP_CRC32 in <sys/auxv.h>."

Updated license hashes due to upstream commit
6d287a3ae9

Fixes:
https://autobuild.buildroot.net/results/b0d/b0dbae7b2c884f5fef0017755b28932a83921a5a/
"check/crc32_arm64.h:27:25: fatal error: sys/auxv.h: No such file or directory
   27 | #               include <sys/auxv.h>"

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 2e2d038918)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-15 08:17:35 +02:00
Bernd Kuhls
8f19b5b809 package/leafnode2: fix build without pod2man
Fixes a build error when pod2man is missing on the host:

  pod2man ./tools/lsmac.pl >lsmac.1 || { rm -f lsmac.1 ; false ; }
  /bin/sh: line 1: pod2man: command not found

Fixes:
https://autobuild.buildroot.net/results/999/9996e81429f90f4615755827ac182094d416c467/

Although the build error only occurs since 2026-03-05 it should be
backported to LTS branches because the last change to the buildroot
package dates back to 2024.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit ec62109990)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-10 14:11:27 +02:00
Bernd Kuhls
8c4c363e56 package/sway: needs pcre2 instead of pcre
Buildroot commit 0645cb39e0 bumped the
package from 1.7 to 1.8.1.

Upstream included commit
f614f35e73
in version 1.8 to switch from pcre to pcre2 but the buildroot package
was not updated accordingly.

Pcre2 was already selected by pango -> libglib2 -> pcre2 so this bug was
never noticed.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e8466476c4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-10 14:10:45 +02:00
Bernd Kuhls
874aae2bec package/luvi: update help text
Buildroot commit 00317f0aff switched the
package from pcre to pcre2 but forgot update the Kconfig help text.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 60a95e04d4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-10 14:09:43 +02:00
Bernd Kuhls
cb34aef3f8 package/freeradius-server: remove redundant pcre dependency
Buildroot commit 736c4c1655 added the
package with two identical code blocks dealing with the dependency to
pcre:

https://gitlab.com/buildroot.org/buildroot/-/blob/2026.02/package/freeradius-server/freeradius-server.mk#L161
https://gitlab.com/buildroot.org/buildroot/-/blob/2026.02/package/freeradius-server/freeradius-server.mk#L218

Remove one of these code blocks.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 6c3a015a5e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-10 14:09:27 +02:00
Bernd Kuhls
1125238c9f package/libinput: security bump version to 1.31.1
https://lore.freedesktop.org/wayland-devel/ac3BI2BjKx53LqmH@quokka/T/#u

Fixes CVE-2026-35093 & CVE-2026-35094.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit b9ac6cce07)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-10 14:03:37 +02:00
Giulio Benetti
53cd2b0d0d package/bind: security bump to version 9.18.48
Release notes:
https://ftp.isc.org/isc/bind9/9.18.48/doc/arm/html/notes.html

Changelog:
https://ftp.isc.org/isc/bind9/9.18.48/doc/arm/html/changelog.html

Fixes bugs:
GL #5817
https://gitlab.isc.org/isc-projects/bind9/-/issues/5817
GL #5800
https://gitlab.isc.org/isc-projects/bind9/-/issues/5800
GL #5826
https://gitlab.isc.org/isc-projects/bind9/-/issues/5826

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f42f5f4dbc)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-10 14:02:57 +02:00
Bernd Kuhls
986b66534e package/giflib: security bump version to 6.1.2
https://sourceforge.net/p/giflib/code/ci/6.1.2/tree/NEWS

Patch 0001 was removed because it is included in this release:
dd8b375e2a/

Patch 0002 is not needed anymore because upstream removed gif2rgb from
the list of installable make targets:
35dc68311a/

Updated license hash due to upstream commit
4a425b7348/

The CVEs mentioned in the release notes (CVE-2021-40633 &
CVE-2025-31344) are related to gif2rgb only.

Build-tested using this defconfig:

  BR2_x86_64=y
  BR2_TOOLCHAIN_EXTERNAL=y
  BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
  BR2_PACKAGE_KODI=y
  BR2_PACKAGE_EFL=y
  # BR2_PACKAGE_EFL_EEZE is not set
  # BR2_PACKAGE_EFL_FONTCONFIG is not set
  # BR2_PACKAGE_EFL_GSTREAMER1 is not set
  # BR2_PACKAGE_EFL_LIBFRIBIDI is not set
  # BR2_PACKAGE_EFL_ELPUT is not set
  # BR2_PACKAGE_EFL_LIBSNDFILE is not set
  # BR2_PACKAGE_EFL_PULSEAUDIO is not set
  # BR2_PACKAGE_EFL_UTIL_LINUX_LIBMOUNT is not set
  BR2_PACKAGE_MESA3D=y
  BR2_PACKAGE_MESA3D_GALLIUM_DRIVER_SOFTPIPE=y
  BR2_PACKAGE_MESA3D_OPENGL_EGL=y
  BR2_PACKAGE_MESA3D_OPENGL_ES=y
  BR2_PACKAGE_XORG7=y
  BR2_PACKAGE_LUAJIT=y
  BR2_PACKAGE_OPENJDK=y
  BR2_PACKAGE_PYTHON3=y
  BR2_PACKAGE_PYTHON3_PY_ONLY=y
  BR2_PACKAGE_IMLIB2=y
  BR2_PACKAGE_IMLIB2_GIF=y
  BR2_PACKAGE_LEPTONICA=y
  BR2_PACKAGE_LIBGDIPLUS=y
  BR2_PACKAGE_WEBP=y
  BR2_PACKAGE_DLIB=y
  BR2_PACKAGE_GDAL=y

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 5388405cfd)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-10 14:00:48 +02:00
Bernd Kuhls
20785f51ff package/kodi: allow build with giflib 6.x
These patches fix build errors which would be introduced by the upcoming
bump of giflib to 6.1.2.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 66c12774cf)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-10 14:00:05 +02:00
Bernd Kuhls
82d17ceacb package/giflib: update tarball URL
Upstream moved all tarballs to new locations:
https://sourceforge.net/p/giflib/bugs/190/

Fixes:
https://autobuild.buildroot.net/results/c7f/c7f918fe7c879706c5a5875ea11c5f8b57007a85/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit ea698142bd)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-10 13:59:17 +02:00
Francois Perrad
6b319ddb5f package/perl: security bump to version 5.42.2
fix CVE 2026-4176 : contains a vulnerable version of Compress::Raw::Zlib

For release notes, see:
https://perldoc.perl.org/5.42.2/perl5422delta

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit d690060618)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-10 12:27:05 +02:00
Luca Ceresoli
829b1819fc system: fix typo in comment
Fix "TARTGET_DIR" -> "TARGET_DIR" typo.

Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 20080af519)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-10 12:20:26 +02:00
Daniel Brát
6f8f031cef package/musl: bump to version 1.2.6
For release announce, see:
https://www.openwall.com/lists/musl/2026/03/20/1

For change log, see:
https://git.musl-libc.org/cgit/musl/tree/WHATSNEW?h=v1.2.6#n2444

This upstream relase includes fix for the CVE-2025-26519 and several other
issues buildroot previously needed to apply its own patches for.
Sha256 of the COPYRIGHT file has changed due to a contributor name change,
licence remains otherwise the same. See:
https://git.musl-libc.org/cgit/musl/commit/COPYRIGHT?id=2fc56aaa9f660ebd735d1595c3501b792af42eb8

Signed-off-by: Daniel Brát <danek.brat@gmail.com>
[Julien: add links in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 9018402c2c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-10 12:20:18 +02:00
Titouan Christophe
b98c6b833f package/cpp-httplib: security bump to v0.40.0
See the release notes:

- https://github.com/yhirose/cpp-httplib/releases/tag/v0.38.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.39.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.40.0

Fixes the following vulnerabilities:

- CVE-2026-33745
- CVE-2026-34441

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 774a09423e)
[thomas: mention security bump]
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-10 12:19:10 +02:00
Titouan Christophe
1316869959 package/cpp-httplib: security bump to v0.37.2
See the release notes of intermediate versions:
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.28.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.29.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.30.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.30.1
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.30.2
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.31.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.32.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.33.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.33.1
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.34.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.35.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.36.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.37.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.37.1
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.37.2

This fixes numerous vulnerabilities:

- CVE-2026-21428:
    cpp-httplib is a C++11 single-file header-only cross platform
    HTTP/HTTPS library. Prior to version 0.30.0, the ``write_headers``
    function does not check for CR & LF characters in user supplied
    headers, allowing untrusted header value to escape header lines. This
    vulnerability allows attackers to add extra headers, modify request
    body unexpectedly & trigger an SSRF attack. When combined with a
    server that supports http1.1 pipelining (springboot, python twisted
    etc), this can be used for server side request forgery (SSRF). Version
    0.30.0 fixes this issue.
    https://www.cve.org/CVERecord?id=CVE-2026-21428

- CVE-2026-22776:
    cpp-httplib is a C++11 single-file header-only cross platform
    HTTP/HTTPS library. Prior to version 0.30.1, a Denial of Service (DoS)
    vulnerability exists in cpp-httplib due to the unsafe handling of
    compressed HTTP request bodies (Content-Encoding: gzip, br, etc.). The
    library validates the payload_max_length against the compressed data
    size received from the network, but does not limit the size of the
    decompressed data stored in memory.
    https://www.cve.org/CVERecord?id=CVE-2026-22776

- CVE-2026-28434:
    cpp-httplib is a C++11 single-file header-only cross platform
    HTTP/HTTPS library. Prior to 0.35.0, when a request handler throws a
    C++ exception and the application has not registered a custom
    exception handler via set_exception_handler(), the library catches the
    exception and writes its message directly into the HTTP response as a
    header named EXCEPTION_WHAT. This header is sent to whoever made the
    request, with no authentication check and no special configuration
    required to trigger it. The behavior is on by default. A developer who
    does not know to opt in to set_exception_handler() will ship a server
    that leaks internal exception messages to any client. This
    vulnerability is fixed in 0.35.0.
    https://www.cve.org/CVERecord?id=CVE-2026-28434

- CVE-2026-28435:
    cpp-httplib is a C++11 single-file header-only cross platform
    HTTP/HTTPS library. Prior to 0.35.0, cpp-httplib (httplib.h) does not
    enforce Server::set_payload_max_length() on the decompressed request
    body when using HandlerWithContentReader (streaming ContentReader)
    with Content-Encoding: gzip (or other supported encodings). A small
    compressed payload can expand beyond the configured payload limit and
    be processed by the application, enabling a payload size limit bypass
    and potential denial of service (CPU/memory exhaustion). This
    vulnerability is fixed in 0.35.0.
    https://www.cve.org/CVERecord?id=CVE-2026-28435

- CVE-2026-29076:
    cpp-httplib is a C++11 single-file header-only cross platform
    HTTP/HTTPS library. Prior to version 0.37.0, cpp-httplib uses
    std::regex (libstdc++) to parse RFC 5987 encoded filename* values in
    multipart Content-Disposition headers. The regex engine in libstdc++
    implements backtracking via deep recursion, consuming one stack frame
    per input character. An attacker can send a single HTTP POST request
    with a crafted filename* parameter that causes uncontrolled stack
    growth, resulting in a stack overflow (SIGSEGV) that crashes the
    server process. This issue has been patched in version 0.37.0.
    https://www.cve.org/CVERecord?id=CVE-2026-29076

- CVE-2026-31870:
    cpp-httplib is a C++11 single-file header-only cross platform
    HTTP/HTTPS library. Prior to 0.37.1, when a cpp-httplib client uses
    the streaming API (httplib::stream::Get, httplib::stream::Post, etc.),
    the library calls std::stoull() directly on the Content-Length header
    value received from the server with no input validation and no
    exception handling. std::stoull throws std::invalid_argument for non-
    numeric strings and std::out_of_range for values exceeding ULLONG_MAX.
    Since nothing catches these exceptions, the C++ runtime calls
    std::terminate(), which kills the process with SIGABRT. Any server the
    client connects to — including servers reached via HTTP redirects,
    third-party APIs, or man-in-the-middle positions can crash the client
    application with a single HTTP response. No authentication is
    required. No interaction from the end user is required. The crash is
    deterministic and immediate. This vulnerability is fixed in 0.37.1.
    https://www.cve.org/CVERecord?id=CVE-2026-31870

- CVE-2026-32627:
    cpp-httplib is a C++11 single-file header-only cross platform
    HTTP/HTTPS library. Prior to 0.37.2, when a cpp-httplib client is
    configured with a proxy and set_follow_location(true), any HTTPS
    redirect it follows will have TLS certificate and hostname
    verification silently disabled on the new connection. The client will
    accept any certificate presented by the redirect target — expired,
    self-signed, or forged — without raising an error or notifying the
    application. A network attacker in a position to return a redirect
    response can fully intercept the follow-up HTTPS connection, including
    any credentials or session tokens in flight. This vulnerability is
    fixed in 0.37.2.
    https://www.cve.org/CVERecord?id=CVE-2026-32627

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 8dad17ea06)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-10 12:17:03 +02:00
Petr Vorel
1f3dbbaabb package/ltp-testsuite: Always require host-pkgconf
Require host-pkgconf only for libtirpc is not enough because libmnl
requires as well.

Upstream added it since 20200515 commit
553ca8ea3b ("net/route: Add netlink based route change tests")
using it in m4/ltp-libmnl.m4.

Later, in 20210524 in commit
6e17e2ba13 ("configure: Improve error message on missing pkg-config")
configure.ac required it explicitly:

m4_ifndef([PKG_CHECK_EXISTS],
	[m4_fatal([must install pkg-config or pkgconfig and pkg.m4 macro (usual dependency), see INSTALL])])

This fixes error:
checking pkg-config is at least version 0.9.0... ./configure: line 7419: br-mips64r6-el-hf-glibc/host/bin/pkg-config: No such file or directory

Signed-off-by: Petr Vorel <petr.vorel@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d421a5d278)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-10 11:59:07 +02:00
Thomas Perale
d75c53a758 package/nghttp2: patch CVE-2026-27135
Fixes the following vulnerability:

- CVE-2026-27135:
    nghttp2 is an implementation of the Hypertext Transfer Protocol
    version 2 in C. Prior to version 1.68.1, the nghttp2 library stops
    reading the incoming data when user facing public API
    `nghttp2_session_terminate_session` or
    `nghttp2_session_terminate_session2` is called by the application.
    They might be called internally by the library when it detects the
    situation that is subject to connection error. Due to the missing
    internal state validation, the library keeps reading the rest of the
    data after one of those APIs is called. Then receiving a malformed
    frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2
    v1.68.1 adds missing state validation to avoid assertion failure. No
    known workarounds are available.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2026-27135
  - 5c7df8fa81

(cherry picked from commit 7d26ff6c14)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-10 11:56:10 +02:00
Franciszek Stachura
f3f4ba919e support/testing: add memcached test
Add a basic runtime test for memcached. The test starts memcached and
checks if it responds to a basic set/get request.

Signed-off-by: Franciszek Stachura <fbstachura@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit aa2d71ac38)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-03 11:53:18 +02:00
Shubham Chakraborty
7c26d4e6be DEVELOPERS: add Shubham Chakraborty as ccache maintainer
Signed-off-by: Shubham Chakraborty <chakrabortyshubham66@gmail.com>
[Julien: add trailing slash]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 6bac6a1a63)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-03 11:53:15 +02:00
Peter Korsgaard
bd446d02af package/rauc: security bump to version 1.15.2
Fixes the following security issue:

CVE-2026-34155: Improper Signing of Plain Bundles Exceeding 2 GiB

RAUC bundles using the 'plain' format exceeding a payload size of 2 GiB
cause an integer overflow which results in a signature which covers only the
first few bytes of the payload.  Given such a bundle with a legitimate
signature, an attacker can modify the part of the payload which is not
covered by the signature.

Bundles using the recommended 'verity' or 'crypt' formats are not affected.

For more details, see the advisory:
https://github.com/rauc/rauc/security/advisories/GHSA-6hj7-q844-m2hx

https://github.com/rauc/rauc/releases/tag/v1.15.2

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 6e4a136363)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-03 11:53:13 +02:00
Bernd Kuhls
2745326e6c package/libpng: security bump to version 1.6.56
Fixes the following security vulnerabilities:

CVE-2026-33416 (high):
Use-after-free via pointer aliasing in `png_set_tRNS` and `png_set_PLTE`.

CVE-2026-33636 (high):
Out-of-bounds read/write in the palette expansion on ARM Neon.

For more details, see the advisories:
https://github.com/pnggroup/libpng/security/advisories/GHSA-m4pc-p4q3-4c7j
https://github.com/pnggroup/libpng/security/advisories/GHSA-wjr5-c57x-95m2

Release notes:
https://github.com/pnggroup/libpng/blob/v1.6.56/ANNOUNCE

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 22e4440eae)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-03 11:53:11 +02:00
Bernd Kuhls
6cb5e52b34 package/freetype: security bump version to 2.14.3
https://sourceforge.net/projects/freetype/files/freetype2/2.14.3/
"- A bunch of potential security problems have been found.  All users
 should update."

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit a9a4d0a7a5)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-03 11:53:09 +02:00
Bernd Kuhls
220744c3aa package/tor: security bump version to 0.4.9.6
https://gitlab.torproject.org/tpo/core/tor/-/blob/tor-0.4.9.6/ReleaseNotes

Fixes TROVE-2026-003 & TROVE-2026-004. See:
https://gitlab.torproject.org/tpo/core/team/-/wikis/NetworkTeam/TROVE

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: add link to TROVE page]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f359f665be)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-03 11:53:07 +02:00
Titouan Christophe
6c09a5fee5 SECURITY.md: add new file
This is an in-tree description of Buildroot's security policies

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 0ce674c244)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-03 11:53:05 +02:00
Giulio Benetti
dccfa5b18f package/bind: security bump to version 9.18.47
Release notes:
https://ftp.isc.org/isc/bind9/9.18.47/doc/arm/html/notes.html

Changelog:
https://ftp.isc.org/isc/bind9/9.18.47/doc/arm/html/changelog.html

Fixes CVE-2026-1519.

Fixes bug:
GL #5708
https://gitlab.isc.org/isc-projects/bind9/-/issues/5708

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 0fa55218f4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-03 11:53:03 +02:00
Vincent Stehlé
b185cceaff boot/edk2: fix build with host gcc >= 15, glibc >= 2.43
The edk2 package fails to build with gcc 15, with the following error:

  EfiRom.c:78:17: error: assignment discards 'const' qualifier from pointer target type [-Werror=discarded-qualifiers]

Cherry-pick one patch from edk2-stable202602 to fix this.

This can be verified with the tests.boot.test_edk2 python tests.

Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Cc: Dick Olsson <hi@senzilla.io>
[Julien: add "host" gcc 15 and glibc 2.43 in commit title]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d18f7e0916)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-03 11:53:01 +02:00
Manuel Diener
17920c622e package/python-django: security bump to 6.0.3
Fixes the following security issues:

CVE-2026-25673 (moderate):
Potential denial-of-service vulnerability in URLField via Unicode
normalization on Windows
https://www.cve.org/CVERecord?id=CVE-2026-25673

CVE-2026-25674 (low): Potential incorrect permissions on newly
created file system objects
https://www.cve.org/CVERecord?id=CVE-2026-25674

See the release notes here:
https://docs.djangoproject.com/en/6.0/releases/6.0.3/

This commit also fixes the license hash file
django/contrib/gis/measure.py, after whitespace cleanup:
090f1da56e (diff-eb11d321d233226d88aeffc485fb6c318a06e807feb1574d80a92a7d6a1461a2)

Signed-off-by: Manuel Diener <manuel.diener@oss.othermo.de>
[Julien: fix license hash for django/contrib/gis/measure.py]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit c8dd9e9a01)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-03 11:52:59 +02:00
Waldemar Brodkorb
8b6b54245e DEVELOPERS: remove Waldemar Brodkorb from zabbix
I am no longer interested in zabbix.

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 83386ecb9c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-03 11:52:57 +02:00
Waldemar Brodkorb
03ef4770e4 package/asterisk: security bump to 22.8.2
See here for detailed changelog:
https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-22.8.2.html

Fixes the following CVEs:

CVE-2026-23739 / GHSA-85x7-54wr-vh42:
Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential
XXE Injection
https://github.com/asterisk/asterisk/security/advisories/GHSA-85x7-54wr-vh42
https://www.cve.org/CVERecord?id=CVE-2026-23739

CVE-2026-23741 / GHSA-rvch-3jmx-3jf3:
ast_coredumper running as root sources ast_debug_tools.conf from
/etc/asterisk; potentially leading to privilege escalation
https://github.com/asterisk/asterisk/security/advisories/GHSA-rvch-3jmx-3jf3
https://www.cve.org/CVERecord?id=CVE-2026-23741

CVE-2026-23738 / GHSA-v6hp-wh3r-cwxh:
The Asterisk embedded web server's /httpstatus page echos user
supplied values(cookie and query string) without sanitization
https://github.com/asterisk/asterisk/security/advisories/GHSA-v6hp-wh3r-cwxh
https://www.cve.org/CVERecord?id=CVE-2026-23738

CVE-2026-23740 / GHSA-xpc6-x892-v83c:
ast_coredumper runs as root, and writes gdb init file to world
writeable folder; leading to potential privilege escalation
https://github.com/asterisk/asterisk/security/advisories/GHSA-xpc6-x892-v83c
https://www.cve.org/CVERecord?id=CVE-2026-23740

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
[Julien: add CVE details in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 84ece21e84)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-04-02 15:28:16 +02:00
Titouan Christophe
731cc7e2a3 {linux, linux-headers}: bump 6.12.x, 6.6.x, 6.1.x, 6.19.x, 6.18.x series
Update the latest kernel releases to:
 - 6.12.77 -> 6.12.79
 - 6.6.129 -> 6.6.130
 - 6.1.166 -> 6.1.167
 - 6.19.9 -> 6.19.10
 - 6.18.19 -> 6.18.20

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2026-03-30 14:41:09 +02:00
Andreas Ziegler
6578fd1729 package/mpd: add missing optional dependency
Config.in selects libiconv in certain situations (uClibc with locales
not enabled). This may lead to a build error with utils/test-pkg -p mpd.

Add missing optional dependency and restore sorting order.

Signed-off-by: Andreas Ziegler <br025@umbiko.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 83e637d7cc)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-26 17:08:05 +01:00
Andreas Ziegler
4712caeeb6 package/mpd: disable build of manuals
The documentation feature was introduced with version 0.22, but is not
used. Instead two other options (also introduced with 0.22) control
building HTML manual and man pages. If the tools needed are not found,
the documentation build finishes silently.

Save Meson some effort by setting both options to 'false'.

Signed-off-by: Andreas Ziegler <br025@umbiko.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e7e2050d54)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-26 17:08:03 +01:00
Andreas Ziegler
557e7816c2 package/mpd: enforce tcp for options using http
Prevent disabling of TCP if some option is selected that uses HTTP.

Fixes:
https://autobuild.buildroot.org/results/59b0be79b1ca1469477e7634205f3eaaebef7d5f

Signed-off-by: Andreas Ziegler <br025@umbiko.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit ee324c5bab)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-26 17:08:01 +01:00
Bernd Kuhls
fdf1bdd0cf package/igh-ethercat: fix build with kernel >= 6.15
Buildroot commit c6e9148197 bumped the
package from 1.6.3 to 1.6.8. The previous version 1.6.3 failed to build
with kernel >= 6.15 as seen here:
https://autobuild.buildroot.net/results/7f4/7f4b3e632a5de67dec2624a2097045ec4d767246/
"examples/mini/mini.c:528:5: error: implicit declaration of function
 'del_timer_sync' [-Wimplicit-function-declaration]
  528 |     del_timer_sync(&timer);"

The bump to 1.6.8 includes a commit which fixes the problem:
240080f110

but it only masked other build errors which were found by the
autobuilders:
https://autobuild.buildroot.net/results/1a5/1a546ee2217e7843b852a5b79b477ef23df6a064/
"examples/tty/tty.c:236:5: error: implicit declaration of function
 'del_timer_sync' [-Wimplicit-function-declaration]
  236 |     del_timer_sync(&timer);"

which need similar fixes.

Fixes:
https://autobuild.buildroot.net/results/0ba/0ba7163e5012309d3a31aa7186ca95a9d5c8de69/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 7fe315a6f7)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-26 17:07:59 +01:00
Bernd Kuhls
b17368f7c1 package/expat: security bump version to 2.7.5
https://github.com/libexpat/libexpat/blob/R_2_7_5/expat/Changes

Fixes CVE-2026-32776, CVE-2026-32777 & CVE-2026-32778.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 763b9c289e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-26 17:07:56 +01:00
Neal Frager
0251ef1466 package/bootgen: fix build issue if host-flex already built
Fix a silent build issue with the host-bootgen package if host-flex is already
built. The host-flex package will install a version of the flexlexer.h header
file that is not compatible with the version embedded in bootgen.

While the build will still 'succeed', the binary will not be correct. This
can be seen by just running the binary that is built. By default, running
bootgen without any parameters should print the help menu, but if the wrong
version of flexlexer.h is used, it will print the following instead:

$ output/host/bin/bootgen

****** Bootgen v2025.1-Merged
  **** Build date : Mar 18 2026-07:08:01
    ** Copyright 1986-2022 Xilinx, Inc. All Rights Reserved.
    ** Copyright 2022-2025 Advanced Micro Devices, Inc. All Rights Reserved.

ERROR: syntax error
-h

Add a patch to the bootgen package that corrects the issue.

Upstream: CR to AMD jira

Signed-off-by: Neal Frager <neal.frager@amd.com>
Tested-by: Steven J. Hill <steven.hill@collins.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 75f62dc669)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-26 17:07:54 +01:00
Vincent Stehlé
4a64ec36cc package/xen: fix armv7 build with gcc-15
Backport a patch from Xen 4.21 to fix the following build errors for Arm v7
with gcc-15:

  xen-4.14.6/xen/include/asm/platforms/midway.h:1: error: header guard '__ASM_ARM_PLATFORMS_MIDWAY_H' followed by '#define' of a different macro [-Werror=header-guard]
  xen-4.14.6/xen/include/asm/platforms/omap5.h:1: error: header guard '__ASM_ARM_PLATFORMS_OMAP5_H' followed by '#define' of a different macro [-Werror=header-guard]

Since the external 32b arm toolchain has been updated to a version based on
gcc-15, the tests.package.test_xen.TestXenArmv7 python test does not build
anymore.
Adding the patch repairs it.

Link: https://gitlab.com/buildroot.org/buildroot/-/jobs/13518318473
Fixes: 86d453a7dc ("toolchain/toolchain-external/toolchain-external-arm-arm: bump to 15.2.rel1")
Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Cc: Alistair Francis <alistair@alistair23.me>
Cc: Dowan Gullient <dowan.gullient@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 0e8739fab2)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-26 17:07:52 +01:00
Manuel Diener
e077238853 DEVELOPERS: add Manuel Diener to several packages
Add myself to packages recently orphaned which I am going to continue.

Signed-off-by: Manuel Diener <manuel.diener@oss.othermo.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit de7bd5034b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-26 17:07:50 +01:00
James Hilliard
955a57bda7 package/wpebackend-fdo: fix EGL_NOT_INITIALIZED crash
Commit 4cd4b2e1e6 updated mesa3d
past version 25.2.0 which deprecated the legacy wayland
EGL_WL_bind_wayland_display interface, as wpebackend-fdo
currently still relies on this functionality ensure that we
enable EGL_WL_bind_wayland_display in mesa3d.

Fixes:
 - https://lore.kernel.org/all/CADvTj4pYf0uymrkZUuWgahWK=pm5CgTJL5U+gwbwKExK1so5jA@mail.gmail.com/

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Acked-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit c897438742)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-26 17:07:48 +01:00
James Hilliard
8061b9f4f7 package/mesa3d: add EGL_WL_bind_wayland_display support
This feature was made optional in mesa3d 25.2.0 as it is deprecated,
however some packages still require it so lets add a new config
option that those packages can select until they no longer require
this feature.

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Reviewed-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit 0260741639)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-26 17:07:46 +01:00
Fabien Lehoussel
6980799e92 support/scripts/generate-cyclonedx: add source attribute to CVEs
Add 'source' attribute to each CVE in vulnerabilities node, including NVD
URL reference to enable proper import into Dependency-Track.

Dependency-Track's VEX importer requires the source attribute to
properly process vulnerability entries. Without it, vulnerabilities are
skipped during import with "does not have an ID and / or source" warnings.

Include the full NVD URL following the CycloneDX 1.6 documentation format:
https://nvd.nist.gov/vuln/detail/{CVE-ID}

Test Environment:
- Buildroot: 2025.02.11 (or master)
- Dependency-Track: v4.13.6

Test Results - BEFORE (without source attribute):
apiserver_1  | 2026-02-23 16:05:40,890 INFO [VexUploadProcessingTask] Processing CycloneDX VEX uploaded to project: e43fe185-c0a3-4e3a-a908-667344a66a9c
apiserver_1  | 2026-02-23 16:05:40,941 WARN [CycloneDXVexImporter] VEX vulnerability at position #0 does not have an ID and / or source; Skipping it
apiserver_1  | 2026-02-23 16:05:40,941 WARN [CycloneDXVexImporter] VEX vulnerability at position #1 does not have an ID and / or source; Skipping it
...
apiserver_1  | 2026-02-23 16:05:40,941 WARN [CycloneDXVexImporter] VEX vulnerability at position #19 does not have an ID and / or source; Skipping it
apiserver_1  | 2026-02-23 16:05:40,941 INFO [CycloneDXVexImporter] The uploaded VEX does not contain any applicable vulnerabilities; Skipping VEX import

Test Results - AFTER (with source):
apiserver_1  | 2026-02-23 16:17:13,492 INFO [VexUploadProcessingTask] Processing CycloneDX VEX uploaded to project: e43fe185-c0a3-4e3a-a908-667344a66a9c
apiserver_1  | 2026-02-23 16:17:14,054 INFO [VexUploadProcessingTask] Completed processing of CycloneDX VEX for project: e43fe185-c0a3-4e3a-a908-667344a66a9c

CVEs are correctly imported in Dependency-Track

Signed-off-by: Fabien Lehoussel <fabien.lehoussel@smile.fr>
Acked-By: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit 3a5e70d1d1)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-26 17:07:43 +01:00
Fabien Lehoussel
2294bcbc27 cve-check: fix CVE URL format
Update NVD source to full URL format following CycloneDC 1.6
specification [1].

Before: "url": "https://nvd.nist.gov/"
After:  "url": "https://nvd.nist.gov/vuln/detail/CVE-XXXX"

[1] https://cyclonedx.org/docs/1.6/json/#vulnerabilities_items_source_url

Signed-off-by: Fabien Lehoussel <fabien.lehoussel@smile.fr>
Acked-By: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit ac466d4b1a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-26 17:07:41 +01:00
Waldemar Brodkorb
a533d160c0 package/uclibc: bump to 1.0.57
Following changes made it into the release:

Joris van Rantwijk (1):
      Fix adjtimex() with TIME64

Waldemar Brodkorb (8):
      sys/stat.h: remove _STAT_VER/_MKNOD_VER
      fix gettid() declaration
      add statx syscall wrapper
      sparc: add optimize build support for leon3
      sparc: sync with Linux kernel definition, fixes gdb compile
      fix compile error on earlier Kernels predating statx
      select: fix compilation failure with very old kernel
      bump version for 1.0.57 release

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 84bc50c82d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-26 17:07:39 +01:00
Julien Olivain
75c2df66f6 package/zfs: add patch to fix build with uclibc >= 1.0.57
uclibc 1.0.57 added a statx() syscall wrapper in upstream commit [1].

zfs fail to build with uclibc 1.0.57 (not yet in Buildroot), because:
1. uclibc <fcntl.h> internally includes <sys/stat.h>, and
2. a zfs test redefines a statx() wrapper with a slightly different
   prototype.

In that case, zfs fails to compile with error:

    tests/zfs-tests/cmd/statx.c:58:1: error: conflicting types for 'statx'; have 'int(int,  const char *, int,  unsigned int,  void *)'

Issue has been reported upstream at [2].

This commit adds a package patch to fix that issue.

[1] d3a819aff2
[2] https://github.com/openzfs/zfs/pull/18316

Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit b6884913ae)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-26 17:07:37 +01:00
Bernd Kuhls
efc22bcd2c package/python-wheel: security bump version to 0.46.3
https://github.com/pypa/wheel/blob/0.46.3/docs/news.rst

Version 0.46.2 fixes CVE-2026-24049:
wheel Allows Arbitrary File Permission Modification via Path Traversal

Fixes:
https://www.cve.org/CVERecord?id=CVE-2026-24049

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: mark the commit as "security" and add info in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 635c145c16)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-26 17:07:35 +01:00
Bernd Kuhls
89a8b82195 package/python-tornado: security bump version to 6.5.5
https://github.com/tornadoweb/tornado/blob/v6.5.5/docs/releases/v6.5.5.rst

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e59cc42d2f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-26 17:07:32 +01:00
Titouan Christophe
c68605456a {linux, linux-headers}: bump 6.19.x, 6.18.x series
Update the latest kernel releases to:
 - 6.19.8 -> 6.19.9
 - 6.18.18 -> 6.18.19

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2026-03-23 11:26:05 +01:00
Bernd Kuhls
7a454d52bd package/python-pyjwt: security bump version to 2.12.1
https://github.com/jpadilla/pyjwt/blob/2.12.1/CHANGELOG.rst

Fixes CVE-2026-32597:
https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 7c5d57fe82)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:56:35 +01:00
Bernd Kuhls
548a063cbb package/python-pyasn1: security bump version to 0.6.2
https://github.com/pyasn1/pyasn1/blob/v0.6.2/CHANGES.rst

Fixes CVE-2026-23490: https://nvd.nist.gov/vuln/detail/CVE-2026-23490

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 517cdc8e13)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:56:33 +01:00
Bernd Kuhls
aae6fb35a0 package/python-flask: security bump version to 3.1.3
https://github.com/pallets/flask/blob/3.1.3/CHANGES.rst

Fixes CVE-2026-27205: https://nvd.nist.gov/vuln/detail/CVE-2026-27205

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 52f46b24ef)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:56:31 +01:00
Bernd Kuhls
588d37a500 package/sqlite: bump version to 3.51.3
https://sqlite.org/releaselog/3_51_3.html

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 171d4d489c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:56:29 +01:00
Bernd Kuhls
0caae05a2a package/libxml2: security bump version to 2.15.2
Release notes:
https://download.gnome.org/sources/libxml2/2.15/libxml2-2.15.2.news

- CVE-2026-1757 fix: Memory leak in xmllint Shell - shell.c
- CVE-2026-0990 fix: Prevent infinite recursion in
  xmlCatalogListXMLResolve
- CVE-2026-0992 fix: Exponential behavior when handling
- parser: Fix infinite loop in xmlCtxtParseContent
- CVE-2025-10911 libxslt related: Ignore next/prev of documents when
  traversing XPath
- CVE-2026-0989 fix: Add RelaxNG include limit

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 4d4dc5f542)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:56:26 +01:00
Julien Olivain
87d2b48dec support/testing: test_xfsprogs: use bootlin toolchain, update kernel
This commit updates the test configuration to switch to a Bootlin
external toolchain. This is needed to get newer toolchain kernel
headers required by newer xfsprogs versions.

xfsprogs upstream commit [1] (included in v6.15) introduced a usage
of the "capacity" field of zoned block devices, introduced in Kernel
commit [2], first included in v5.9.

This commit also updates the runtime test Kernel version
to the LTS 6.18.18. This is because the default filesystem options
of mkfs.xfs were updated in upstream commit [3] to include new
features supported in the new Kernel 6.18.y LTS series. The commit [3]
is included in xfsprogs v6.18.

[1] https://git.kernel.org/pub/scm/fs/xfs/xfsprogs-dev.git/commit/?id=48ccc2459039309cfbaf358febea53a86f07827c
[2] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=82394db7383d33641f3f565bd79792fb41b1741f
[3] https://git.kernel.org/pub/scm/fs/xfs/xfsprogs-dev.git/commit/?id=54aad16b4b9b923442b4042afaba4438ca1aa868

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit c03712d8ec)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:56:24 +01:00
Neal Frager
d31d4f2b69 board/versal2/post-image.sh: remove incorrect $BINARIES_DIR
Remove incorrect $BINARIES_DIR reference from the symbolic link creation to
make a relative path and not an absolute path.

Signed-off-by: Neal Frager <neal.frager@amd.com>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit 1d603b78c0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:56:22 +01:00
Thomas Richard
e5f300a871 board/stmicroelectronics/stm32mp135f-dk: fix silent crash in U-Boot
Backport upstream patches to fix a silent crash in U-Boot on
STM32MP135F-DK.

Fixes:

  799d184e89

Signed-off-by: Thomas Richard <thomas.richard@bootlin.com>
[Romain: add Fixes link]
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit 5af624386e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:56:20 +01:00
Yann E. MORIN
667111a94d docs/manual: use space-separated list for BR2_EXTERNAL
Specifying a list of br2-external trees is poorly documented, and the
only example uses a colon to separate the br2-external paths.

Adding the support for colon-separated list is the biggest mistake that
was made when introducing support for multiple br2-external [0]. Indeed,
both space and colon can be used to separate entries in the list, and it
is also possible to mix the two. However, internally, the list is stored
as a space-separated list, and all the code will split on spaces.

Besides, all other lists in Buildroot are a space-separated:
    BR2_ROOTFS_DEVICE_TABLE
    BR2_ROOTFS_STATIC_DEVICE_TABLE
    BR2_TARGET_TZ_ZONELIST
    BR2_ROOTFS_USERS_TABLES
    BR2_ROOTFS_OVERLAY
    BR2_ROOTFS_PRE_BUILD_SCRIPT
    BR2_ROOTFS_POST_BUILD_SCRIPT
    BR2_ROOTFS_POST_FAKEROOT_SCRIPT
    BR2_ROOTFS_POST_IMAGE_SCRIPT
    ...

So, using colons is odd.

The fact that BR2_EXTERNAL is passed on the command line rather than
being a Kconfig item is not a reason enough to justify that it be
colon-separated.

Change the documentation to only mention using a space-separated list.

Of course, for backward compatibility, we keep the code as-is to accept
a colon-separated list, but we just do not advertise it.

Note that keeping the split on colons means that colons are not accepted
in pathnames of br2-external trees; in practice, this is not a new
restriction, or one that could lift as usign colons in Makefiles are
problematic anyway.

[0] in 20cd497387 core: add support for multiple br2-external trees

Reported-by: Fiona Klute (WIWA) <fiona.klute@gmx.de>
Reported-by: Brandon Maier <Brandon.Maier@collins.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit f9cdca48a5)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:56:18 +01:00
Yann E. MORIN
b7aa889e19 support/br2-external: fix remaining shellcheck errors
Boring changes: either do what shellcheck suggested, or comment why we
don't want to fix the code.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit 72e068001b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:56:15 +01:00
Yann E. MORIN
846bd9b002 support/br2-external: remove leftover trap
The trap was initially introduced in c5fa9308ea (core/br2-external:
properly report unexpected errors), in 2017, to catch all unexpected
errors, back when a single file was generated, and errors emitted to
stderr.

Since commit d027cd75d0 (core: generate all br2-external files in
one go), in 2019 the single output file 'ofile' is no longer created,
as multiple output files were then introduced, while messages for
*expected errors* were redirected to a Makefile variable assignment
emitted on stdout, at which point the script just exits (in error);
expected failures only occur in do_validate().

Unexpected errors can only occur on failure to create, or write to,
output files, either '.br2-external.mk' in do_validate() or do_mk(),
or any of the kconfig fragments in do_kconfig(). Cause for failure to
create those can only be a no-space-left-on-device condition, as they
are created in a directory that was just created by the script earlier
in main(), and thus has the necessary mode; failure to create that
directory is now caught explicitly.

A trap on ERR is not called when the shell exits explicitly with a call
to 'exit', thus, only failures to create or write to output file would
be caught. In that case, we are better off not trying to write to those
files anyway: failure to create the file would already be reported by
the shell on stderr, while disk-full would not allow to store the output
anyway...

In any case, the script exits in error, which is going to be caught by
the caller, which will terminate.

So, drop the trap altogether.

As a side effect, that squelches a shellcheck error.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit 244e4283a9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:56:13 +01:00
Bernd Kuhls
3447410977 package/php: bump version to 8.5.4
https://www.php.net/ChangeLog-8.php#8.5.4
https://news-web.php.net/php.announce/486

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 712e3e10cf)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:56:11 +01:00
Bernd Kuhls
8ccf7b3887 package/libarchive: security bump version to 3.8.6
https://github.com/libarchive/libarchive/releases/tag/v3.8.6
"Libarchive 3.8.6 is a security and bugfix release."

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d950ff2488)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:56:09 +01:00
Bernd Kuhls
cfb1f63448 package/libcurl: security bump to version 8.19.0
https://curl.se/ch/8.19.0.html
https://curl.se/docs/security.html

Fixes the following CVEs:

CVE-2026-3805: use after free in SMB connection reuse
CVE-2026-3784: wrong proxy connection reuse with credentials
CVE-2026-3783: token leak with redirect and netrc
CVE-2026-1965: bad reuse of HTTP Negotiate connection

Switch to sha256 tarball hash provided by upstream.

Updated license hash due to copyright year bump:
e83c82f05f

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: add back pgp signature info in hash file]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 3a5e071e4f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:56:07 +01:00
Christian Stewart
cab7c3734e package/go: security bump to version 1.26.1
Building Go 1.26 and later requires Go 1.24.6 or later for bootstrap.

To support this we use Go version 1.25.8 as the version for
go-bootstrap-stage5 and have the build for Go 1.26.1 depend on
go-bootstrap-stage5.

Go version 1.25.8 is the latest Go version we can build using
go-bootstrap-stage4.

The package build for go-bootstrap-stage5 is effectively identical to
go-bootstrap-stage4 with only the Go version and stage number changed.

Go 1.28 is expected to require a minor release of Go 1.26 for bootstrap.

Fixes the following security vulnerabilities:

- CVE-2026-25679: net/url: reject IPv6 literal not at start of host
- CVE-2026-27142: html/template: URLs in meta attribute actions not escaped
- CVE-2026-27137: crypto/x509: incorrect enforcement of email constraints
- CVE-2026-27138: crypto/x509: panic in name constraint checking: certificates
- CVE-2026-27139: os: FileInfo can escape from a Root

For full release notes, see:
https://go.dev/doc/devel/release#go1.26.0

Signed-off-by: Christian Stewart <christian@aperture.us>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 43d1323196)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:56:05 +01:00
Julien Olivain
629bdb457b configs/aarch64_efi: switch to external toolchain
This commit switches the aarch64_efi_defconfig to an external glibc
stable Bootlin toolchain, to follow recommendation from [1].

Since an external toolchain is used, the linux-headers.hash custom
hash file is no longer needed and is removed.

[1] https://elinux.org/Buildroot:DeveloperDaysELCE2024#Rules_for_defconfigs

Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 18b8544235)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:56:03 +01:00
Julien Olivain
d9824ad5d9 support/testing: test_connman: new runtime test
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e55952b173)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:56:01 +01:00
Romain Naour
ea69fbb1ad boot/uboot: improve U-Boot OP-TEE TEE format options help text
OP-TEE generates a few binaries that can be used by u-boot on some
platforms (Rockchip, Texas Instruments K3) using TEE variable.

Add a link to the OP-TEE documentation were we can find easily the
desciption for each TEE format that can be used by u-boot.

For convenience, copy tee.elf and tee.bin description in each option
choice help text.

Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit a5f5c08dcd)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:55:59 +01:00
Marcus Hoffmann
8bdf79c098 DEVELOPERS: remove Marcus Hoffmann from no longer used packages
Remove myself from packages that I'm no longer personally interested in.

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 1210e4efeb)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:55:57 +01:00
Giulio Benetti
47e01beb12 package/nfs-utils: security bump version to 2.8.6
Release announce:
https://lore.kernel.org/linux-nfs/4d58bf28-a3e0-4496-bae8-05387da27054@redhat.com/

This update fixes:
https://www.cve.org/CVERecord?id=CVE-2025-12801

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 7dfd2feb44)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:55:55 +01:00
Giulio Benetti
1f053b6b85 package/nfs-utils: bump version to 2.8.5
Release announce:
https://lore.kernel.org/linux-nfs/fdf3631f-e924-4e4c-bd9f-db5b40a90bfe@redhat.com/

With patch [1] option nfsv41 required to be renamed to blkmapd.

[1]: https://git.linux-nfs.org/?p=steved/nfs-utils.git;a=commit;h=59e85671e59f7ccbf66dcf72ce7462bf4932cc78

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Reviewed-by: Petr Vorel <petr.vorel@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e7928fef42)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-19 11:55:53 +01:00
Titouan Christophe
44ba95ab09 {linux, linux-headers}: bump 6.12.x, 6.6.x, 6.1.x, 5.15.x, 5.10.x, 6.19.x, 6.18.x series
Update the latest kernel releases to:
 - 6.12.74 -> 6.12.77
 - 6.6.127 -> 6.6.129
 - 6.1.164 -> 6.1.166
 - 5.15.201 -> 5.15.202
 - 5.10.251 -> 5.10.252
 - 6.19.5 -> 6.19.8
 - 6.18.15 -> 6.18.18

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2026-03-16 15:13:51 +01:00
Bernd Kuhls
a6a9c1930e package/jasper: fix build without threads
Buildroot commit 03a1732dea bumped the
package from 2.0.33 to 4.2.8. This bump includes upstream commit
91fca09209
which was added to version 3.0.0 and causes build errors when threads
are not available:

    message(FATAL_ERROR "Threading support is not available.")

because JAS_ENABLE_MULTITHREADING_SUPPORT defaults to ON:
https://github.com/jasper-software/jasper/blob/version-4.2.8/CMakeLists.txt#L124

Add configure options to disable thread support when needed.

Fixes:
https://autobuild.buildroot.net/results/870/870d6adbac166b22cce217628d477b1bce538320/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d32b12b548)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:22:02 +01:00
Bernd Kuhls
d8dc041795 package/libheif: needs gcc >= 10
Fixes build error with gcc 9.x:

output/build/libheif-1.21.1/libheif/nclx.h:128:50: error:
 'bool nclx_profile::operator==(const nclx_profile&)
 const' cannot be defaulted

 using this defconfig:

  BR2_arm=y
  BR2_TOOLCHAIN_EXTERNAL=y
  BR2_TOOLCHAIN_EXTERNAL_CUSTOM=y
  BR2_TOOLCHAIN_EXTERNAL_DOWNLOAD=y
  BR2_TOOLCHAIN_EXTERNAL_URL="http://autobuild.buildroot.org/toolchains/tarballs/br-arm-full-static-2020.11.2.tar.bz2"
  BR2_TOOLCHAIN_EXTERNAL_GCC_9=y
  BR2_TOOLCHAIN_EXTERNAL_HEADERS_4_4=y
  BR2_TOOLCHAIN_EXTERNAL_LOCALE=y
  # BR2_TOOLCHAIN_EXTERNAL_HAS_THREADS_DEBUG is not set
  BR2_TOOLCHAIN_EXTERNAL_CXX=y
  BR2_STATIC_LIBS=y
  BR2_PACKAGE_LIBHEIF=y

According to https://github.com/strukturag/libheif/issues/1615#issuecomment-3457979167
gcc >= 10 with support for C++20 is needed for the package.

The failing code was introduced upstream in version 0.21.0 with commit
a62f933e38
which was added to buildroot with commit
a8aed698c7.

Also removed -std=c++11 from CXXFLAGS.

The build error was not yet recorded by the autobuilders.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 7323bcc1d4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:21:17 +01:00
Bernd Kuhls
9c2ea8a463 package/libvips: fix static build
Buildroot commit 72c7d99e22 switched the
build system to meson which causes an error during configure:

output/build/libvips-8.17.2/meson.build:108:4:
 ERROR: Problem encountered: GModule is not supported on your system,
 please reconfigure with -Dmodules=disabled

using this defconfig:

  BR2_arm=y
  BR2_TOOLCHAIN_EXTERNAL=y
  BR2_TOOLCHAIN_EXTERNAL_CUSTOM=y
  BR2_TOOLCHAIN_EXTERNAL_DOWNLOAD=y
  BR2_TOOLCHAIN_EXTERNAL_URL="http://autobuild.buildroot.org/toolchains/tarballs/br-arm-full-static-2020.11.2.tar.bz2"
  BR2_TOOLCHAIN_EXTERNAL_GCC_9=y
  BR2_TOOLCHAIN_EXTERNAL_HEADERS_4_4=y
  BR2_TOOLCHAIN_EXTERNAL_LOCALE=y
  # BR2_TOOLCHAIN_EXTERNAL_HAS_THREADS_DEBUG is not set
  BR2_TOOLCHAIN_EXTERNAL_CXX=y
  BR2_STATIC_LIBS=y
  BR2_PACKAGE_LIBVIPS=y

Added configure options for -Dmodules to fix the problem which was not
yet caught by the autobuilders.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 86d0fcd77b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:17:19 +01:00
Shubham Chakraborty
40f1d20242 package/python3: remove nis and ossaudiodev modules
These modules were dropped in Python 3.13 as per PEP 594.
The current version in Buildroot is 3.14.3.

- Remove the TODO and related config overrides in python3.mk.
- Remove BR2_PACKAGE_PYTHON3_OSSAUDIODEV from Config.in.
- Add BR2_PACKAGE_PYTHON3_OSSAUDIODEV to Config.in.legacy.

See [1] [2] [3].

[1] https://peps.python.org/pep-0594/
[2] fc07fe4e37
[3] 17e1fe0f9b

Signed-off-by: Shubham Chakraborty <chakrabortyshubham66@gmail.com>
[Julien:
 - add links in commit log
 - move legacy option in 2026.05 section
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit df6e7a6664)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:16:11 +01:00
Bernd Kuhls
a3fa3e9cd7 package/faketime: fix host build with glibc 2.43
Fixes:
https://autobuild.buildroot.net/results/911/9112933e2560b155a9c61f321874ec245b62b2a5/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 088c3602fd)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:11:29 +01:00
Bernd Kuhls
254712b12a package/docker: Fix build with gcc-15.x
Add patch from Debian to fix build error with gcc-15.x

Fixes:
https://autobuild.buildroot.net/results/495/4956555fd033d43c1877e66141789bcd06aff5be/

Patch sent to fork which is used by Arch Linux:
https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=wmdocker

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit cc3647e73f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:11:04 +01:00
Bernd Kuhls
70302f9267 package/postgresql: bump version to 18.3
https://www.postgresql.org/about/news/postgresql-183-179-1613-1517-and-1422-released-3246/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Reviewed-by: Maxim Kochetkov <fido_max@inbox.ru>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d62b605c1a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:10:17 +01:00
Bernd Kuhls
bbbad699ae DEVELOPERS: remove Bernd Kuhls from libldns
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 156e2be96c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:09:57 +01:00
Dowan Gullient
4e594d0eda support/testing/infra: update artifacts URL to https and .org domain
The artifacts URL has been moved to https and domain to .org to
improve security and avoid redirection issues. This ensures that
downloads of kernels and rootfs images during runtime tests are
encrypted and verified.

The change has been tested by running a runtime test, confirming the
correct download and renaming of artifacts from the new URL:

    Downloading to .../tmpyotq8uor
    Renaming from .../tmpyotq8uor to .../kernel-versatile-5.10.202

Signed-off-by: Dowan Gullient <dowan.gullient@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 8313d8a2fa)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:06:47 +01:00
Bernd Kuhls
3bfce36750 package/libtpms: security bump version to 0.10.2
https://github.com/stefanberger/libtpms/blob/v0.10.2/CHANGES

Fixes CVE-2026-21444.

Added comment to hash file about locally computed hashes.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit b1c4276c2d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:04:46 +01:00
Bernd Kuhls
60d110ac8d package/libtpms: fix build with host gcc >= 15.x, glibc >= 2.43
Fixes:
https://autobuild.buildroot.net/results/7a6/7a6ea7c513e8f1dcc32d868108bfb2a907d6fe85/

The previous change to src/tpm_library.c dates back to 2024:
https://github.com/stefanberger/libtpms/commits/master/src/tpm_library.c
so a backport to buildroot LTS branches should be considered.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: reword title to mention glibc 2.43]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f773fd6787)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:03:42 +01:00
Julien Olivain
b2dedc5541 support/testing: boot/test_grub: remove 32bit EFI test
EDK2 removed OVMF IA32 support in commit [1], which is included in
version edk2-stable202511. This commit removes the test relying on it.

[1] 1fb88ffe28

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit bd06eace37)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:03:16 +01:00
Julien Olivain
d0d88a9d47 support/testing: fs/test_iso9660: remove 32bit EFI tests
EDK2 removed OVMF IA32 support in commit [1], which is included in
version edk2-stable202511. This commit removes tests relying on it.

[1] 1fb88ffe28

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit cf16e1abe0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:02:53 +01:00
Bernd Kuhls
9f755efa4b package/clamav: security bump version to 1.5.2
https://blog.clamav.net/2026/03/clamav-152-and-144-security-patch.html

Fixes CVE-2026-20031: https://www.cve.org/CVERecord?id=CVE-2026-20031

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d225a6ffad)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:02:24 +01:00
Bernd Kuhls
47addd38d2 package/exiv2: security bump version to 0.28.8
https://exiv2.org/whatsnew.html
https://github.com/Exiv2/exiv2/blob/v0.28.8/doc/ChangeLog

This release fixes three low-severity vulnerabilities:

CVE-2026-25884: Out-of-bounds read in CrwMap::decode0x0805
CVE-2026-27596: Integer overflow in LoaderNative::getData() causes out-of-bounds read
CVE-2026-27631: Uncaught exception: cannot create std::vector larger than max_size()

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 1c3aa5f977)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:01:53 +01:00
Bernd Kuhls
69c4221f25 package/freetype: security bump version to 2.14.2
Release notes:
https://sourceforge.net/projects/freetype/files/freetype2/2.14.2/

Fixes CVE-2026-23865: https://seclists.org/oss-sec/2026/q1/253

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 6c3933d14b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:01:05 +01:00
Adrian Perez de Castro
2ea2018960 package/libsoup3: security bump to 3.6.6
While there is only one CVE number assigned (CVE-2025-14523) for one of
the patches included in this release, the bulk of the the changes are
security fixes.

Release notes may be found at:

  25eac15300

Fixes:
https://www.cve.org/CVERecord?id=CVE-2025-14523

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 1a9998e511)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-03-13 16:00:36 +01:00
2479 changed files with 30824 additions and 22014 deletions

View File

@@ -52,6 +52,7 @@ board/stmicroelectronics/stm32f429-disco/flash.sh Shellcheck
board/stmicroelectronics/stm32f469-disco/flash_sd.sh Shellcheck
board/stmicroelectronics/stm32f469-disco/flash_xip.sh Shellcheck
board/synopsys/axs10x/post-build.sh Shellcheck
board/technologic/ts4900/post-image.sh Shellcheck
board/udoo/common/post-build.sh Shellcheck
boot/afboot-stm32/0003-Makefile-disable-stack-protector.patch lib_patch.Upstream
boot/optee-os/3.13.0/0001-core-zlib-fix-build-warning-when-_LFS64_LARGEFILE-is.patch lib_patch.Upstream
@@ -69,6 +70,7 @@ boot/syslinux/0013-Fix-build-with-gnu-efi-version-3.0.9.patch lib_patch.Upstream
boot/syslinux/0014-Fix-build-with-binutils-note-gnu-property-section.patch lib_patch.Upstream
boot/syslinux/0016-Workaround-multiple-definition-of-symbol-errors.patch lib_patch.Upstream
boot/syslinux/0017-Replace-builtin-strlen-that-appears-to-get-optimized.patch lib_patch.Upstream
configs/am574x_idk_defconfig lib_defconfig.ForceCheckHash
configs/arcturus_ucls1012a_defconfig lib_defconfig.ForceCheckHash
configs/asus_tinker-s_rk3288_defconfig lib_defconfig.ForceCheckHash
configs/atmel_sama5d27_som1_ek_mmc_dev_defconfig lib_defconfig.ForceCheckHash
@@ -91,6 +93,7 @@ configs/ci20_defconfig lib_defconfig.ForceCheckHash
configs/freescale_p1025twr_defconfig lib_defconfig.ForceCheckHash
configs/freescale_t1040d4rdb_defconfig lib_defconfig.ForceCheckHash
configs/freescale_t2080_qds_rdb_defconfig lib_defconfig.ForceCheckHash
configs/friendlyarm_nanopi_r2s_defconfig lib_defconfig.ForceCheckHash
configs/globalscale_espressobin_defconfig lib_defconfig.ForceCheckHash
configs/imx23evk_defconfig lib_defconfig.ForceCheckHash
configs/imx6-sabreauto_defconfig lib_defconfig.ForceCheckHash
@@ -99,10 +102,13 @@ configs/imx6-sabresd_qt5_defconfig lib_defconfig.ForceCheckHash
configs/imx6slevk_defconfig lib_defconfig.ForceCheckHash
configs/imx6sx-sdb_defconfig lib_defconfig.ForceCheckHash
configs/imx6ulevk_defconfig lib_defconfig.ForceCheckHash
configs/imx6ullevk_defconfig lib_defconfig.ForceCheckHash
configs/imx6ulpico_defconfig lib_defconfig.ForceCheckHash
configs/imx7dpico_defconfig lib_defconfig.ForceCheckHash
configs/imx8mqevk_defconfig lib_defconfig.ForceCheckHash
configs/khadas_vim3_defconfig lib_defconfig.ForceCheckHash
configs/kontron_bl_imx8mm_defconfig lib_defconfig.ForceCheckHash
configs/kontron_smarc_sal28_defconfig lib_defconfig.ForceCheckHash
configs/mender_x86_64_efi_defconfig lib_defconfig.ForceCheckHash
configs/microchip_sam9x60ek_mmc_defconfig lib_defconfig.ForceCheckHash
configs/microchip_sam9x60ek_mmc_dev_defconfig lib_defconfig.ForceCheckHash
@@ -128,6 +134,9 @@ configs/olpc_xo175_defconfig lib_defconfig.ForceCheckHash
configs/olpc_xo1_defconfig lib_defconfig.ForceCheckHash
configs/orangepi_pc2_defconfig lib_defconfig.ForceCheckHash
configs/orangepi_zero_plus_defconfig lib_defconfig.ForceCheckHash
configs/pine64_defconfig lib_defconfig.ForceCheckHash
configs/pine64_pinecube_defconfig lib_defconfig.ForceCheckHash
configs/s6lx9_microboard_defconfig lib_defconfig.ForceCheckHash
configs/sipeed_lichee_rv_defconfig lib_defconfig.ForceCheckHash
configs/sipeed_lichee_rv_dock_defconfig lib_defconfig.ForceCheckHash
configs/sipeed_licheepi_nano_defconfig lib_defconfig.ForceCheckHash
@@ -148,6 +157,8 @@ configs/solidrun_clearfog_gt_8k_defconfig lib_defconfig.ForceCheckHash
configs/solidrun_macchiatobin_defconfig lib_defconfig.ForceCheckHash
configs/stm32mp157c_odyssey_defconfig lib_defconfig.ForceCheckHash
configs/terasic_de10nano_cyclone5_defconfig lib_defconfig.ForceCheckHash
configs/ts4900_defconfig lib_defconfig.ForceCheckHash
configs/ts5500_defconfig lib_defconfig.ForceCheckHash
configs/uevm5432_defconfig lib_defconfig.ForceCheckHash
configs/visionfive_defconfig lib_defconfig.ForceCheckHash
configs/wandboard_defconfig lib_defconfig.ForceCheckHash
@@ -185,6 +196,7 @@ package/at/0001-Makefile.in-fix-make-install-for-non-root-don-t-stri.patch lib_p
package/at/S99at lib_sysv.Indent lib_sysv.Variables
package/attr/0001-build-with-older-GCCs.patch lib_patch.Upstream
package/aumix/0001-fix-incorrect-makefile-am.patch lib_patch.Upstream
package/autoconf/0001-dont-add-dirty-to-version.patch lib_patch.Upstream
package/automake/0001-noman.patch lib_patch.Upstream
package/avahi/S05avahi-setup.sh lib_sysv.Indent lib_sysv.Variables
package/avahi/S50avahi-daemon lib_sysv.Indent lib_sysv.Variables
@@ -234,6 +246,7 @@ package/cfm/S65cfm lib_sysv.Indent lib_sysv.Variables
package/cgroupfs-mount/S30cgroupfs Shellcheck lib_sysv.Indent lib_sysv.Variables
package/chipmunk/0001-Fix-build-failure-on-musl.patch lib_patch.Upstream
package/chrony/S49chronyd lib_sysv.Variables
package/cmake/0001-rename-cmake-rootfile.patch lib_patch.Upstream
package/collectd/0001-src-netlink.c-remove-REG_NOERROR.patch lib_patch.Upstream
package/connman/S45connman lib_sysv.Variables
package/copas/0001-Do-not-load-coxpcall-for-LuaJIT.patch lib_patch.Upstream
@@ -261,6 +274,8 @@ package/dahdi-tools/0002-no-perl-manpages.patch lib_patch.Upstream
package/dante/0001-fix-sparc-compile.patch lib_patch.Upstream
package/dante/0002-osdep-m4-Remove-getaddrinfo-too-low-checks.patch lib_patch.Upstream
package/dante/S50dante Shellcheck lib_sysv.Indent lib_sysv.Variables
package/daq/0001-Fix-build-against-the-musl-C-library.patch lib_patch.Upstream
package/daq/0002-parallel-grammar.patch lib_patch.Upstream
package/darkhttpd/S50darkhttpd Shellcheck lib_sysv.Indent lib_sysv.Variables
package/davfs2/0001-src-Makefile.am-do-not-hardcode-fstack-protector-str.patch lib_patch.Upstream
package/dbus-cpp/0001-gcc4.7.patch lib_patch.Upstream
@@ -282,6 +297,7 @@ package/dmalloc/0005-configure-use-LD-instead-of-hard-coding-ld.patch lib_patch.
package/docopt-cpp/0001-only-build-one-target-use-BUILD_SHARED_LIBS-where-appropriate.patch lib_patch.Upstream
package/domoticz/S99domoticz Shellcheck
package/dovecot/0001-auth-Fix-handling-passdbs-with-identical-driver-args.patch lib_patch.Upstream
package/dracut/0001-dracut.sh-don-t-unset-LD_PRELOAD.patch lib_patch.Upstream
package/dracut/merged-usr-module-setup.sh Shellcheck
package/dropbear/S50dropbear Shellcheck lib_sysv.Indent lib_sysv.Variables
package/dt/0001-adjust-os-symlink.patch lib_patch.Upstream
@@ -340,18 +356,29 @@ package/freescale-imx/imx-uuc/S80imx-uuc Shellcheck lib_sysv.Indent lib_sysv.Var
package/freescale-imx/imx-vpu-hantro/0001-Fix-ion.h-header-inclusion-to-be-standard.patch lib_patch.Upstream
package/freescale-imx/imx-vpu-hantro/0002-Fix-build-with-uclibc-toolchain.patch lib_patch.Upstream
package/freescale-imx/imx-vpu-hantro/0003-Fix-Linux-kernel-version-header.patch lib_patch.Upstream
package/freeswitch/0001-libs-srtp-crypto-hash-hmac_ossl.c-fix-build-with-lib.patch lib_patch.Upstream
package/frr/S50frr Shellcheck
package/fstrcmp/0001-disable-rpath.patch lib_patch.Upstream
package/ftop/0001-overflow.patch lib_patch.Upstream
package/fwts/0001-build-do-not-use-Werror.patch lib_patch.Upstream
package/fxdiv/0001-CMake-don-t-enable-CXX-unless-building-tests-benchma.patch lib_patch.Upstream
package/fxload/0001-fix-static-build.patch lib_patch.Upstream
package/gcc/14.4.0/0001-disable-split-stack-for-non-thread-builds.patch lib_patch.Upstream
package/gcc/15.3.0/0001-disable-split-stack-for-non-thread-builds.patch lib_patch.Upstream
package/gcc/16.2.0/0001-disable-split-stack-for-non-thread-builds.patch lib_patch.Upstream
package/gcc/13.4.0/0001-disable-split-stack-for-non-thread-builds.patch lib_patch.Upstream
package/gcc/14.3.0/0001-disable-split-stack-for-non-thread-builds.patch lib_patch.Upstream
package/gcc/15.2.0/0001-disable-split-stack-for-non-thread-builds.patch lib_patch.Upstream
package/gcc/8.4.0/0001-xtensa-fix-PR-target-91880.patch lib_patch.Upstream
package/gcc/8.4.0/0002-Revert-re-PR-target-92095-internal-error-with-O1-mcp.patch lib_patch.Upstream
package/gcc/8.4.0/0003-libsanitizer-Remove-cyclades-from-libsanitizer.patch lib_patch.Upstream
package/gcc/8.4.0/0004-disable-split-stack-for-non-thread-builds.patch lib_patch.Upstream
package/gdb/14.2/0001-ppc-ptrace-Define-pt_regs-uapi_pt_regs-on-GLIBC-syst.patch lib_patch.Upstream
package/gdb/14.2/0002-sh-ptrace-Define-pt_-dsp-regs-uapi_pt_-dsp-regs-on-G.patch lib_patch.Upstream
package/gdb/14.2/0003-use-asm-sgidefs.h.patch lib_patch.Upstream
package/gdb/14.2/0004-gdbserver-fix-build-for-m68k.patch lib_patch.Upstream
package/gdb/14.2/0005-nat-fork-inferior-include-linux-ptrace.h.patch lib_patch.Upstream
package/gdb/14.2/0006-Fix-getrandom-compile-for-uclibc-v1.0.35.patch lib_patch.Upstream
package/gdb/14.2/0007-fix-musl-build-on-riscv.patch lib_patch.Upstream
package/gdb/14.2/0008-gdbserver-Makefile.in-fix-NLS-build.patch lib_patch.Upstream
package/gdb/14.2/0009-gdb-Fix-native-build-on-xtensa.patch lib_patch.Upstream
package/gdb/15.2/0001-ppc-ptrace-Define-pt_regs-uapi_pt_regs-on-GLIBC-syst.patch lib_patch.Upstream
package/gdb/15.2/0002-sh-ptrace-Define-pt_-dsp-regs-uapi_pt_-dsp-regs-on-G.patch lib_patch.Upstream
package/gdb/15.2/0003-use-asm-sgidefs.h.patch lib_patch.Upstream
@@ -370,21 +397,13 @@ package/gdb/16.3/0006-Fix-getrandom-compile-for-uclibc-v1.0.35.patch lib_patch.U
package/gdb/16.3/0007-fix-musl-build-on-riscv.patch lib_patch.Upstream
package/gdb/16.3/0008-gdbserver-Makefile.in-fix-NLS-build.patch lib_patch.Upstream
package/gdb/16.3/0009-gdb-Fix-native-build-on-xtensa.patch lib_patch.Upstream
package/gdb/17.1/0001-ppc-ptrace-Define-pt_regs-uapi_pt_regs-on-GLIBC-syst.patch lib_patch.Upstream
package/gdb/17.1/0002-sh-ptrace-Define-pt_-dsp-regs-uapi_pt_-dsp-regs-on-G.patch lib_patch.Upstream
package/gdb/17.1/0003-use-asm-sgidefs.h.patch lib_patch.Upstream
package/gdb/17.1/0004-gdbserver-fix-build-for-m68k.patch lib_patch.Upstream
package/gdb/17.1/0005-nat-fork-inferior-include-linux-ptrace.h.patch lib_patch.Upstream
package/gdb/17.1/0006-Fix-getrandom-compile-for-uclibc-v1.0.35.patch lib_patch.Upstream
package/gdb/17.1/0007-fix-musl-build-on-riscv.patch lib_patch.Upstream
package/gdb/17.1/0008-gdbserver-Makefile.in-fix-NLS-build.patch lib_patch.Upstream
package/gdb/17.1/0009-gdb-Fix-native-build-on-xtensa.patch lib_patch.Upstream
package/genpart/0001-fix-return-code.patch lib_patch.Upstream
package/gensio/0001-Fix-missing-EVP_PKEY_ED25519-build-error-on-libressl.patch lib_patch.Upstream
package/gerbera/S99gerbera lib_sysv.Indent
package/git-crypt/0001-fix-build-with-libressl-3.5.0.patch lib_patch.Upstream
package/glorytun/0001-Add-support-for-Apple-silicon.patch lib_patch.Upstream
package/glorytun/0002-aegis256.c-fix-aarch64-build-with-uclibc.patch lib_patch.Upstream
package/gnu-efi/0001-Make.defaults-don-t-override-ARCH-when-cross-compili.patch lib_patch.Upstream
package/gnupg/0001-build-Always-use-EXTERN_UNLESS_MAIN_MODULE-pattern.patch lib_patch.Upstream
package/gnuplot/0001-configure-add-without-demo-option.patch lib_patch.Upstream
package/go/go-src/0001-build.go-explicit-option-for-crosscompilation.patch lib_patch.Upstream
@@ -394,6 +413,7 @@ package/gpsd/S50gpsd Shellcheck lib_sysv.Indent lib_sysv.Variables
package/gptfdisk/0001-gptcurses-partially-revert-Tweaks-for-building-on-th.patch lib_patch.Upstream
package/gstreamer1/gstd/0001-Don-t-require-gstd-check-user-xenv.sh-for-systemd-se.patch lib_patch.Upstream
package/guile/0001-calculate-csqrt_manually.patch lib_patch.Upstream
package/guile/0002-Makefile.am-fix-build-without-makeinfo.patch lib_patch.Upstream
package/gutenprint/0001-use-pregen-xmli18n-header.patch lib_patch.Upstream
package/gutenprint/0002-cups-support-replaces-static-with-static-libtool-lib.patch lib_patch.Upstream
package/harfbuzz/0001-meson.build-check-for-pthread.h.patch lib_patch.Upstream
@@ -445,9 +465,11 @@ package/irqbalance/S13irqbalance Shellcheck lib_sysv.Indent lib_sysv.Variables
package/irrlicht/0001-override-CPPFLAGS-CXXFLAGS-and-CFLAGS-in-Makefile.patch lib_patch.Upstream
package/irrlicht/0002-makefile-override-LDFLAGS-and-remove-obsolete-X11R6-.patch lib_patch.Upstream
package/iucode-tool/S00iucode-tool lib_sysv.Variables
package/janus-gateway/0001-disable-ssp.patch lib_patch.Upstream
package/kexec-lite/0001-clean-restart.patch lib_patch.Upstream
package/keyutils/0001-fix-install-rule.patch lib_patch.Upstream
package/keyutils/0002-cifs.patch lib_patch.Sob lib_patch.Upstream
package/kmod/0001-fix-O_CLOEXEC.patch lib_patch.Upstream
package/kodi/S50kodi Shellcheck lib_sysv.Variables
package/lbase64/0001-retro-compatible-with-Lua-5.1.patch lib_patch.Upstream
package/lcdproc/0001-LCDd.conf.patch lib_patch.Upstream
@@ -457,6 +479,8 @@ package/leafnode2/0001-cross_makefile.patch lib_patch.Upstream
package/leveldb/0001-Fix-compilation-with-g-4.8.2.patch lib_patch.Upstream
package/leveldb/0002-CMake-install-libmemenv.a.patch lib_patch.Upstream
package/leveldb/0003-CMakeLists.txt-check-for-atomic-library.patch lib_patch.Upstream
package/lftp/0001-Fix-build-with-LibreSSL-following-commit-537f37898.patch lib_patch.Upstream
package/lftp/0002-src-lftp_ssl.c-fix-build-with-libressl-2.7.0.patch lib_patch.Upstream
package/libabseil-cpp/0001-force-position-independent-code.patch lib_patch.Upstream
package/libargon2/0001-libargon2-dont-fail-on-existing-symlink.patch lib_patch.Upstream
package/libart/0001-art-config-cross.patch lib_patch.Sob lib_patch.Upstream
@@ -483,6 +507,7 @@ package/libgcrypt/0001-configure.ac-add-an-option-to-disable-tests.patch lib_pat
package/libgpiod/0001-build-add-a-configure-switch-for-building-examples.patch lib_patch.Upstream
package/libgsm/0001-Misc-fixes-from-Archlinux.patch lib_patch.Upstream
package/libgtk3/0001-Remove-Gdk-dependency-from-gtk-encode-symbolic-svg.patch lib_patch.Upstream
package/libhdhomerun/0001-dont-strip.patch lib_patch.Upstream
package/libjson/0001-fix-broken-makefile.patch lib_patch.Upstream
package/libks/0001-CMakeLists.txt-honour-BUILD_TESTING.patch lib_patch.Upstream
package/liblinear/0001-build-static-lib.patch lib_patch.Upstream
@@ -514,6 +539,7 @@ package/liboping/0002-Open-raw-sockets-when-adding-hosts-not-when-doing-th.patch
package/liboping/0003-Fix-compile-break-with-GCC-7-buffer-overflow-with-snprintf.patch lib_patch.Upstream
package/liboping/0004-Fix-compile-error-on-GCC-7.patch lib_patch.Upstream
package/liboping/0005-src-oping.c-always-use-s-style-format-for-printf-sty.patch lib_patch.Upstream
package/libp11/0001-src-p11_attr.c-fix-build-with-gcc-4.8.patch lib_patch.Upstream
package/libpthsem/0001-fix-build-on-linux-3.x-host.patch lib_patch.Upstream
package/libressl/0001-always-expose-SSL_OP_NO_TLSv1_3.patch lib_patch.Upstream
package/librsvg/0001-gdk-pixbuf-loader-Makefile.am-set-GDK_PIXBUF_MODULED.patch lib_patch.Upstream
@@ -553,10 +579,12 @@ package/lirc-tools/0002-configure-add-disable-doc-option.patch lib_patch.Upstrea
package/lirc-tools/S25lircd lib_sysv.Indent lib_sysv.Variables
package/live555/0001-Add-a-pkg-config-file-for-the-shared-libraries.patch lib_patch.Upstream
package/lldpd/S60lldpd Shellcheck lib_sysv.Indent lib_sysv.Variables
package/lm-sensors/0001-no-host-ldconfig.patch lib_patch.Upstream
package/lm-sensors/0001-static-build.patch lib_patch.Upstream
package/lm-sensors/0002-no-host-ldconfig.patch lib_patch.Upstream
package/lmbench/0001-scripts-build-use-bin-bash-as-shell.patch lib_patch.Upstream
package/lmbench/0002-src-Makefile-add-lmbench-to-list-of-executables.patch lib_patch.Upstream
package/lmbench/0003-TOO_LONG-100-usec-to-prevent-memsize-from-timingout-.patch lib_patch.Upstream
package/localedef/0002-relax-dependency-on-GCC-to-4.8-and-binutils-to-2.24.patch lib_patch.Upstream
package/lockfile-progs/0001-sus3v-legacy.patch lib_patch.Sob lib_patch.Upstream
package/lshw/0001-solve-Compile-error-when-g-version-is-less-than-5.patch lib_patch.Upstream
package/ltrace/0001-arm-plt.patch lib_patch.Upstream
@@ -604,6 +632,7 @@ package/meson/0001-Prefer-ext-static-libs-when-default-library-static.patch lib_
package/meson/0002-mesonbuild-dependencies-base.py-add-pkg_config_stati.patch lib_patch.Upstream
package/mfgtools/0001-lnx_def.h-fix-conflicting-declaration-of-__time64_t.patch lib_patch.Upstream
package/mii-diag/0001-strchr.patch lib_patch.Sob lib_patch.Upstream
package/mini-snmpd/0001-linux.c-fix-musl-build.patch lib_patch.Upstream
package/minidlna/S60minidlnad Shellcheck lib_sysv.Indent lib_sysv.Variables
package/minissdpd/S50minissdpd Shellcheck lib_sysv.Indent lib_sysv.Variables
package/modem-manager/S44modem-manager Shellcheck lib_sysv.Variables
@@ -617,6 +646,7 @@ package/mpir/0001-mpn-arm-udiv.asm-workaround-binutils-bug-14887.patch lib_patch
package/mraa/0001-include-Declare-gVERSION-global-as-extern.patch lib_patch.Upstream
package/mrouted/S41mrouted NotExecutable
package/mrp/S65mrp lib_sysv.Indent lib_sysv.Variables
package/mstpd/0001-bridge-stp.in-support-different-versions-of-pidof-13.patch lib_patch.Upstream
package/multipath-tools/S60multipathd Shellcheck
package/musl/0001-avoid-kernel-if_ether.h.patch lib_patch.Upstream
package/musl/0002-package-musl-Make-scheduler-functions-Linux-compatib.patch lib_patch.Upstream
@@ -676,9 +706,8 @@ package/olsr/0006-build-patch-for-gpsd-3-25.patch lib_patch.Upstream
package/olsr/S50olsr Shellcheck lib_sysv.Indent lib_sysv.Variables
package/open-plc-utils/0001-Remove-OWNER-and-GROUPS-parameters-to-install.patch lib_patch.Upstream
package/open2300/0001-fix-makefile.patch lib_patch.Upstream
package/openjdk/17.0.18+8/0001-Add-ARCv2-ISA-processors-support-to-Zero.patch lib_patch.Upstream
package/openjdk/21.0.10+7/0001-Add-ARCv2-ISA-processors-support-to-Zero.patch lib_patch.Upstream
package/openjdk/25.0.2+10/0001-Add-ARCv2-ISA-processors-support-to-Zero.patch lib_patch.Upstream
package/openjdk/17.0.12+7/0001-Add-ARCv2-ISA-processors-support-to-Zero.patch lib_patch.Upstream
package/openjdk/21.0.4+7/0001-Add-ARCv2-ISA-processors-support-to-Zero.patch lib_patch.Upstream
package/openldap/0001-fix-bignum.patch lib_patch.Upstream
package/openldap/0002-disable-docs.patch lib_patch.Upstream
package/openntpd/S49ntp Shellcheck lib_sysv.Variables
@@ -692,6 +721,7 @@ package/openrc/0003-init.d-agetty-replace-sbin-agetty-by-sbin-getty.patch lib_pa
package/openrc/0004-init.d-agetty-start-agetty-after-all-sevices.patch lib_patch.Upstream
package/openrc/0005-runlevels-do-not-add-agetty.tty-1-6-if-MKSYSVINIT-ye.patch lib_patch.Upstream
package/openrc/0006-Also-create-run-lock-subsys-directory.patch lib_patch.Upstream
package/openswan/0001-lib-libopenswan-constants.c-workaround-missing-ns_t_.patch lib_patch.Upstream
package/opentyrian/0001-Move-definitions-that-don-t-need-to-be-exposed-from-opl-h-to-opl-c.patch lib_patch.Upstream
package/openvmtools/0001-no_cflags_werror.patch lib_patch.Upstream
package/openvmtools/0002-dont-force-cppflags.patch lib_patch.Upstream
@@ -716,6 +746,8 @@ package/paxtest/0001-genpaxtest-move-log-location.patch lib_patch.Upstream
package/paxtest/0002-paxtest-page-alignment-ARM-and-NIOS2-arch.patch lib_patch.Upstream
package/pcm-tools/0001-pmu-query.py-fix-python3-errors-add-linux-platform-s.patch lib_patch.Upstream
package/pcmanfm/0001-po-de-po-fix-build-with-gettext-tiny.patch lib_patch.Upstream
package/pcre/0001-Kill-compatibility-bits.patch lib_patch.Upstream
package/pcre/0002-Disable-C-unit-tests.patch lib_patch.Upstream
package/pdmenu/0001-autoconf-makeinfo.in-link-with-INTLLIBS-if-needed.patch lib_patch.Upstream
package/pdmenu/0002-Makefile-autoconf-makeinfo.in-support-build-install-.patch lib_patch.Upstream
package/perl-net-ssleay/0001-fix-build-system.patch lib_patch.Upstream
@@ -731,6 +763,7 @@ package/php/0004-Call-apxs-with-correct-prefix.patch lib_patch.Upstream
package/pifmrds/0001-Makefile-cross-compile-friendly.patch lib_patch.Upstream
package/pifmrds/0002-Makefile-use-LDFLAGS.patch lib_patch.Upstream
package/pifmrds/0003-Makefile-fix-static-link.patch lib_patch.Upstream
package/pigpio/S50pigpio Shellcheck lib_sysv.Variables
package/pkgconf/0001-Only-prefix-with-the-sysroot-a-subset-of-variables.patch lib_patch.Upstream
package/pkgconf/pkg-config.in Shellcheck
package/poke/0001-configure.ac-HELP2MAN-replace-by-true-when-cross-com.patch lib_patch.Upstream
@@ -748,6 +781,10 @@ package/prosody/0002-add-pidfile.patch lib_patch.Upstream
package/prosody/S50prosody Shellcheck lib_sysv.Indent lib_sysv.Variables
package/proxychains-ng/0001-add-configure-check-for-non-POSIX-compliant-getnameinfo-signature.patch lib_patch.Upstream
package/ptpd/S65ptpd Shellcheck lib_sysv.Indent lib_sysv.Variables
package/ptpd2/0001-musl.patch lib_patch.Upstream
package/ptpd2/0002-ntp_isc_md5-rename-EVP_MD_CTX-into-PTPD_EVP_MD_CTX.patch lib_patch.Upstream
package/ptpd2/0003-Solve-issue-25-Removing-type-U64-from-net-snmp-relat.patch lib_patch.Upstream
package/ptpd2/S65ptpd2 Shellcheck lib_sysv.Indent lib_sysv.Variables
package/pulseaudio/0001-shm.c-use-_Static_assert-instead-of-static_assert-fo.patch lib_patch.Upstream
package/pulseaudio/S50pulseaudio lib_sysv.ConsecutiveEmptyLines lib_sysv.EmptyLastLine lib_sysv.Indent lib_sysv.Variables
package/pulseview/0001-Replace-obsolete-deprecated-Qt-methods.patch lib_patch.Upstream
@@ -766,7 +803,11 @@ package/qextserialport/0001-Create-a-main-include-file-QExtSerialPort.patch lib_
package/qextserialport/0002-Tell-qmake-to-add-a-pkgconfig-file-to-ease-usage-wit.patch lib_patch.Upstream
package/qt5/qt5base/0001-qtbase-Fix-build-error-when-using-EGL.patch lib_patch.Upstream
package/qt5/qt5base/0002-double-conversion-enable-for-microblaze.patch lib_patch.Upstream
package/qt5/qt5base/0003-double-conversion-enable-for-nios2.patch lib_patch.Upstream
package/qt5/qt5base/0004-double-conversion-enable-for-xtensa.patch lib_patch.Upstream
package/qt5/qt5base/0005-eglfs-avoid-breaking-compilation-for-obscure-EGLNativeDisplayType-types.patch lib_patch.Upstream
package/qt5/qt5base/0006-Fix-build-on-riscv32.patch lib_patch.Upstream
package/qt5/qt5base/0007-src-corelib-configure.json-fix-atomicfptr-detection.patch lib_patch.Upstream
package/qt5/qt5base/0008-eglconvenience-add-missing-QList-include.patch lib_patch.Upstream
package/qt5/qt5declarative/0001-qsgtexture-fix-debug-build-with-uclibc.patch lib_patch.Upstream
package/qt5/qt5declarative/0002-qv4regexp_p-needs-c-limits-include-instead-of-plain-.patch lib_patch.Upstream
@@ -774,8 +815,10 @@ package/qt5/qt5enginio/0001-Do-not-use-deprecated-QLinkedList.patch lib_patch.Up
package/qt5/qt5location/0001-3rdparty-mapbox-gl-native-fix-musl-compile-pthread_g.patch lib_patch.Upstream
package/qt5/qt5script/0001-Detect-32-bits-armv8-a-architecture.patch lib_patch.Upstream
package/qt5/qt5tools/0001-Disable-designer-tool-fixes-configure-error.patch lib_patch.Upstream
package/qt5/qt5webengine-chromium/0001-Don-t-rebase-sysroot-path.patch lib_patch.Upstream
package/qt5/qt5webengine-chromium/0001-Add-python3-build-support.patch lib_patch.Upstream
package/qt5/qt5webengine-chromium/0002-Don-t-rebase-sysroot-path.patch lib_patch.Upstream
package/qt5/qt5webengine/0001-gn.pro-don-t-link-statically-with-libstc.patch lib_patch.Upstream
package/qt5/qt5webengine/0002-Add-python3-build-support.patch lib_patch.Upstream
package/qt5/qt5webkit/0001-WinCairo-PlayStation-ICU-68.1-no-longer-exposes-FALS.patch lib_patch.Upstream
package/qt5/qt5webkit/0002-Fix-compilation-with-Python-3.9-avoid-passing-encodi.patch lib_patch.Upstream
package/qt5/qt5webkit/0003-Let-Bison-generate-the-header-directly-to-fix-build-.patch lib_patch.Upstream
@@ -795,12 +838,16 @@ package/restorecond/S02restorecond Shellcheck
package/ripgrep/0001-puts-jemalloc-allocator-behind-a-cargo-feature-flag.patch lib_patch.Upstream
package/riscv-isa-sim/0001-riscv-disable-precompiled-headers.patch lib_patch.Upstream
package/rng-tools/S21rngd Shellcheck lib_sysv.Variables
package/rocksdb/0001-build_tools-build_detect_platform-fix-C-tests.patch lib_patch.Upstream
package/rpcbind/0001-Remove-yellow-pages-support.patch lib_patch.Upstream
package/rpcbind/S30rpcbind lib_sysv.EmptyLastLine lib_sysv.Indent lib_sysv.Variables
package/rt-tests/0001-Fix-a-build-issue-with-uClibc-ng.patch lib_patch.Upstream
package/rubix/0001-dont-use-legacy-functions.patch lib_patch.Upstream
package/rubix/0002-misc-fixes.patch lib_patch.Sob lib_patch.Upstream
package/rygel/S99rygel Shellcheck lib_sysv.Indent lib_sysv.Variables
package/s6-linux-init/0001-configure-add-D_GNU_SOURCE.patch lib_patch.Upstream
package/samba4/0001-build-find-pre-built-heimdal-build-tools-in-case-of-.patch lib_patch.Upstream
package/samba4/0002-ldap_message_test.c-include-stdint.h-before-cmoka.h.patch lib_patch.Upstream
package/samba4/S91smb Shellcheck lib_sysv.Indent lib_sysv.Variables
package/sane-backends/0001-sane_backend-add-missing-config.h.patch lib_patch.Upstream
package/screen/0001-Do-not-create-backup-of-old-installed-binary.patch lib_patch.Upstream
@@ -820,6 +867,9 @@ package/sentry-native/0001-sentry.h-include-ucontext.h.patch lib_patch.Upstream
package/ser2net/S50ser2net Shellcheck lib_sysv.Indent lib_sysv.Variables
package/setools/0001-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch lib_patch.Upstream
package/setserial/0001-build-system-fix.patch lib_patch.Upstream
package/shadowsocks-libev/0001-configure.ac-use-pkg-config-to-find-netfilter_conntr.patch lib_patch.Upstream
package/shadowsocks-libev/0002-fix-maybe-uninitialized-errors.patch lib_patch.Upstream
package/shadowsocks-libev/0003-lib-Makefile.am-remove-static-from-LDFLAGS.patch lib_patch.Upstream
package/shairport-sync/S99shairport-sync Shellcheck lib_sysv.Indent lib_sysv.Variables
package/shared-mime-info/0001-Remove-incorrect-dependency-from-install-data-hook.patch lib_patch.Upstream
package/shellinabox/0001-Makefile-disable-always-building-statically.patch lib_patch.Upstream
@@ -829,6 +879,14 @@ package/smcroute/S41smcroute NotExecutable lib_sysv.Indent lib_sysv.Variables
package/smstools3/0001-fix-Makefile.patch lib_patch.Upstream
package/smstools3/0002-fix-build-with-gcc-10.x.patch lib_patch.Upstream
package/smstools3/S50smsd Shellcheck lib_sysv.Variables
package/snort/0001-configure.in-Avoid-path-poisoning-with-libpcap.patch lib_patch.Upstream
package/snort/0002-configure.in-Allow-to-override-the-INADDR_NONE-check.patch lib_patch.Upstream
package/snort/0003-configure.in-convert-AC_RUN_IFELSE-to-AC_CHECK_MEMBE.patch lib_patch.Upstream
package/snort/0004-configure.in-convert-AC_RUN_IFELSE-to-AC_COMPILE_IFE.patch lib_patch.Upstream
package/snort/0005-fix-sparc.patch lib_patch.Upstream
package/snort/0006-Fix-compile-error-when-building-against-uclibc-or-mu.patch lib_patch.Upstream
package/snort/0007-Fix-error-when-building-on-a-Fedora-host-machine.patch lib_patch.Upstream
package/snort/0008-Fix-NO-OPTIMIZE.patch lib_patch.Upstream
package/solarus/0001-cmake-remove-Werror.patch lib_patch.Upstream
package/solarus/0002-Add-a-basic-FindOpenGLES2.cmake.patch lib_patch.Sob lib_patch.Upstream
package/sox/0001-Make-SoX-support-uclibc-based-toolchains.patch lib_patch.Upstream
@@ -867,6 +925,7 @@ package/ti-sgx-um/0001-Makefile-do-not-install-init-script.patch lib_patch.Upstr
package/ti-sgx-um/S80ti-sgx lib_sysv.Variables
package/ti-utils/0001-plt.h-fix-build-with-gcc-10.patch lib_patch.Upstream
package/tinyalsa/0001-include-time.h-before-asound.h.patch lib_patch.Upstream
package/tinycompress/0001-wave-add-time.h-missing-header-inclusion.patch lib_patch.Upstream
package/tinydtls/0001-sha2-sha2.c-fix-build-on-big-endian.patch lib_patch.Upstream
package/transmission/S92transmission Shellcheck lib_sysv.ConsecutiveEmptyLines lib_sysv.Indent lib_sysv.Variables
package/triggerhappy/S10triggerhappy Shellcheck lib_sysv.Indent lib_sysv.Variables
@@ -901,6 +960,7 @@ package/vala/0001-dont-add-dirty-to-valac-version.patch lib_patch.Upstream
package/vala/vala-wrapper Shellcheck
package/valgrind/0001-workaround-SIGSEGV-on-PPC.patch lib_patch.Upstream
package/valgrind/0002-Define-PTRACE_GETSIGINFO-on-PowerPC-when-not-availab.patch lib_patch.Upstream
package/vboot-utils/0001-Add-missing-definition-of-MTD_CHAR_MAJOR.patch lib_patch.Upstream
package/vdr/0001-getloadavg.patch lib_patch.Upstream
package/vlc/0001-Disable-building-of-statically-linked-vlc-binary.patch lib_patch.Upstream
package/vlc/0002-automake-add-subdir-objects-option.patch lib_patch.Upstream
@@ -955,8 +1015,12 @@ package/x11r7/xdriver_xf86-video-mach64/0001-cross-compile.patch lib_patch.Upstr
package/x11r7/xdriver_xf86-video-tdfx/0001-cross.patch lib_patch.Upstream
package/x11r7/xserver_xorg-server/0001-include-misc.h-fix-uClibc-build.patch lib_patch.Upstream
package/x11r7/xserver_xorg-server/S40xorg Shellcheck lib_sysv.Variables
package/x11r7/xwayland/0001-include-misc.h-fix-uClibc-build.patch lib_patch.Upstream
package/xen/0001-9pfs-include-linux-limits.h-for-XATTR_SIZE_MAX.patch lib_patch.Upstream
package/xen/0002-Fix-build-with-64-bits-time_t.patch lib_patch.Upstream
package/xen/0003-libs-light-fix-tv_sec-printf-format.patch lib_patch.Upstream
package/xen/0004-libs-light-fix-tv_sec-fprintf-format.patch lib_patch.Upstream
package/xl2tp/xl2tpd lib_shellscript.TrailingSpace
package/xml-security-c/0001-fix-build-with-libressl-3.5.0.patch lib_patch.Upstream
package/yajl/0001-Let-the-shared-and-the-static-library-have-the-same-.patch lib_patch.Upstream
package/yajl/0002-cmake-disable-shared-library-build-when-BUILD_SHARED.patch lib_patch.Upstream
package/yajl/0003-Link-with-shared-libyajl-in-a-shared-build.patch lib_patch.Upstream

788
CHANGES
View File

@@ -1,223 +1,3 @@
2026.05.1, released July 15, 2026
Important / security related fixes:
apache: CVE-2026-29167, CVE-2026-29170, CVE-2026-34355, CVE-2026-34356,
CVE-2026-42535, CVE-2026-42536, CVE-2026-43951, CVE-2026-44119,
CVE-2026-44185, CVE-2026-44186, CVE-2026-44631, CVE-2026-48913,
CVE-2026-49975
asterisk: GHSA-3g56-cgrh-95p5, GHSA-3rhj-hhw7-m6fw,
GHSA-4pgv-j3mr-3rcp, GHSA-589g-qgf8-m6mx, GHSA-746q-794h-cc7f,
GHSA-8jhw-m2hg-vp3h, GHSA-8jw3-ccr9-xrmf, GHSA-g8q2-p36q-94f6,
GHSA-h5hv-jmgj-92q2, GHSA-j2mm-57pq-jh94, GHSA-mxgm-8c6f-5p8f,
GHSA-ph27-3m5q-mj5m, GHSA-q9fr-m7g8-6ph5, GHSA-qf8j-jp7h-c5hx,
GHSA-r6c2-hwc2-j4mp, GHSA-vfhr-r9x9-c687, GHSA-vrfp-mg3q-3959,
GHSA-wcvv-g26m-wx5c, GHSA-x348-j6c9-77f3, GHSA-xgj6-2gc5-5x9c
avahi: CVE-2026-34933
bind: (no CVE assigned), CVE-2026-3593
clamav: CVE-2026-20213, CVE-2026-20214, CVE-2026-20215, CVE-2026-20216,
CVE-2026-20217, CVE-2026-20243, CVE-2026-20244, CVE-2026-41676
cpp-httplib: CVE-2026-45352, CVE-2026-45372, CVE-2026-46527
cups-filters: CVE-2025-64503
expat: CVE-2026-50219, CVE-2026-56131, CVE-2026-56132, CVE-2026-56403,
CVE-2026-56404, CVE-2026-56405, CVE-2026-56406, CVE-2026-56407,
CVE-2026-56408, CVE-2026-56409, CVE-2026-56410, CVE-2026-56411,
CVE-2026-56412
fetchmail: (no CVE assigned)
ghostscript: (no CVE assigned)
gnupg2: CVE-2026-34182
imagemagick: CVE-2026-48724, CVE-2026-48733, CVE-2026-48734,
CVE-2026-48994, CVE-2026-49218, CVE-2026-49219, CVE-2026-53460,
CVE-2026-53461, CVE-2026-53462, CVE-2026-53463, CVE-2026-53464,
CVE-2026-53465
jq: CVE-2026-32316, CVE-2026-33947, CVE-2026-33948, CVE-2026-39979,
CVE-2026-40164, CVE-2026-40612, CVE-2026-41256, CVE-2026-41257,
CVE-2026-43894, CVE-2026-43896, CVE-2026-44777, CVE-2026-49839,
CVE-2026-54679, GHSA-gf4g-95wj-4q4r, GHSA-hj52-j2c9-r8r4
libarchive: (no CVE assigned)
libcurl: CVE-2026-10536, CVE-2026-11352, CVE-2026-11564,
CVE-2026-11586, CVE-2026-11856, CVE-2026-12064, CVE-2026-8286,
CVE-2026-8458, CVE-2026-8924, CVE-2026-8925, CVE-2026-8926,
CVE-2026-8927, CVE-2026-8932, CVE-2026-9079, CVE-2026-9080,
CVE-2026-9545, CVE-2026-9546, CVE-2026-9547
libevent: (no CVE assigned)
libgsasl: CVE-2026-48829
libopenssl: CVE-2026-34180, CVE-2026-34181, CVE-2026-34182,
CVE-2026-34183, CVE-2026-42764, CVE-2026-42766, CVE-2026-42767,
CVE-2026-42768, CVE-2026-42769, CVE-2026-42770, CVE-2026-45445,
CVE-2026-45446, CVE-2026-45447, CVE-2026-7383, CVE-2026-9076
libssh2: CVE-2026-55199, CVE-2026-55200
mariadb: CVE-2026-48163, CVE-2026-48165, CVE-2026-49261
mongoose: (no CVE assigned yet)
nginx: CVE-2026-42055, CVE-2026-48142
openjpeg: CVE-2026-6192
openvpn: CVE-2026-11771, CVE-2026-12932, CVE-2026-12996,
CVE-2026-13117, CVE-2026-13122, CVE-2026-13379, CVE-2026-13698
php: CVE-2026-14355
python-django: CVE-2026-35192, CVE-2026-35193, CVE-2026-48587,
CVE-2026-5766, CVE-2026-6873, CVE-2026-6907, CVE-2026-7666,
CVE-2026-8404
python3: CVE-2026-11940, CVE-2026-9669
redis: CVE-2026-23479, CVE-2026-23631, CVE-2026-25243
ruby: CVE-2026-46727
rust: CVE-2025-15661, CVE-2026-55199, CVE-2026-55200
squid: CVE-2026-47729, CVE-2026-50012
sudo: CVE-2026-35535
tiff: CVE-2026-36849
tmux: CVE-2026-11623
tor: TROVE-2026-025, TROVE-2026-026.
util-linux: CVE-2026-27456, CVE-2026-53612, CVE-2026-53613,
CVE-2026-53614
webkitgtk: CVE-2026-28847, CVE-2026-28883, CVE-2026-28901,
CVE-2026-28902, CVE-2026-28903, CVE-2026-28904, CVE-2026-28905,
CVE-2026-28907, CVE-2026-28942, CVE-2026-28946, CVE-2026-28947,
CVE-2026-28953, CVE-2026-28955, CVE-2026-28958, CVE-2026-43658,
CVE-2026-43660
wolfssl: CVE-2026-10097, CVE-2026-10098, CVE-2026-10512,
CVE-2026-10592, CVE-2026-11310, CVE-2026-11703, CVE-2026-11999,
CVE-2026-12340, CVE-2026-55958, CVE-2026-55960, CVE-2026-55961,
CVE-2026-55962, CVE-2026-55964, CVE-2026-55967, CVE-2026-6091,
CVE-2026-6092, CVE-2026-6094, CVE-2026-6291, CVE-2026-6325,
CVE-2026-6329, CVE-2026-6330, CVE-2026-6331, CVE-2026-6412,
CVE-2026-6450, CVE-2026-6678, CVE-2026-6681, CVE-2026-6731,
CVE-2026-7511, CVE-2026-7531, CVE-2026-7532, CVE-2026-8720
Toolchain:
- gcc: bump 15.x series to 15.3.0
- gcc:: bump 14.x series to 14.4.0
Infrastructure updates/fixes:
- support/testing: various internal refactorings
- support/testing Improve TestPythonPy3NetworkmanagerGoi
- support/testing: improve iptables package test
- generate-cyclonedx: fixup scp-style git sites
- support/testing: Fix test_gnupg2
Updated / fixed packages: apache, asterisk, avahi, bind, bind, clamav,
cpp-httplib, cups-filters, expat, fetchmail, gcc, gcc:, ghostscript,
gnupg2, hwdata, imagemagick, iptables, jq, jq, kodi-screensaver-rsxs,
libarchive, libcurl, libepoxy, libevent, libglib2,
libglib2-bootstrap, libgsasl, libopenssl, libssh2, libssh2, linux,
mariadb, mdnsd, mongoose, mosquitto, mpd, nginx, ntp, openjpeg,
openrc, openvpn, passt, php, python-django, python3, python3, redis,
rsync, ruby, rust, shadow, shim, squid, strongswan, sudo, tiff, tmux,
tor, util-linux, util-linux, util-linux, webkitgtk, wolfssl
2026.05, released June 8th, 2026
Various fixes.
Defconfigs: Correct legal-info for at91sam9x5ek*
(at91bootstrap3) and Arcturus ucp1020 (Linux)
Updated/fixed packages: jailhouse, libde265, libinput, libusb,
php, python3, runc
2026.05-rc4, released June 4th, 2026
Fixes all over the tree.
Infrastructure:
- dependencies: detect and reject buggy uutils 'install'
program as used in Ubuntu 26.04
- pkg-generic: Cleanup /usr/share/info/dir in the target
- generate-cyclonedx / cve-check: Various fixes for better
CycloneDX / BSI TR-03183-2 compliance
- linux: No longer forcibly disable CONFIG_WERROR
- 'make show-info-all' added, which works like 'make
show-info' but for all packages. The package hash files are
now also included in the show-info{,-all} output.
Architectures:
- Drop support for the (rare) PA-RISC 1.0 variant
Updated/fixed packages: aardvark-dns, arm-trusted-firmware,
asterisk, babeld, bpftrace, busybox, ca-certificates, cairo,
capnproto, collectd, cppdb, crucible, cups-filters,
docker-cli, docker-engine, drm-info, efl, esp-hosted, exim,
faad2, freeipmi, freeswitch, gcc-bare-metal, gdb, gerbera,
glibc, graphene, gst1-plugins-bad, gst1-plugins-good,
gstreamer1, harfbuzz, heirloom-mailx, hiredis, hplip, icu,
jemalloc, jq, kodi, lcms2, libbpf, libdill, libdrm, libenca,
libgit2, libheif, libks, libmad, libmicrohttpd,
libmodsecurity, libpthsem, libssh2, liburing, llvm-project,
lrzip, lrzsz, lua-sdl2, mesa3d, mpd, mrp, ndctl, netatalk,
netavark, odhcp6c, openblas, opencv4, opendoas, openscap, php,
podman, poppler, powerpc-utils, privoxy, python-ecdsa,
python-gymnasium, python3, qt53d, qt5webengine-chromium,
qt6base, readline, redis, rpcbind, rtl8188eu,
rtl8812au-aircrack-ng, rtl8822cs, runc, rust, rust-bin,
samba4, sane-airscan, sane-backends, sdl2_image, sqlite,
sshfs, stellarium, suricata, sway, sysrepo, tor, unzip,
ustream-ssl, util-linux, vlc, vorbis-tools, weston,
wireless-regdb, xdriver_xf86-video-nv, xen, xerces,
xserver_xorg-server, xwayland, zsh
Removed packages: daq, kodi-pvr-hdhomerun, libhdhomerun,
libphidget, phidgetwebservice, pigpio, ptpd2, xml-security-c,
zeek
2026.05-rc3, released May 29th, 2026
Fixes all over the tree.
Updated/fixed packages: kexec, libde265, libheif,
llvm-project, mariadb, mesa3d, mpd, nginx, putty,
python-urllib3, radvd, samba4, unbound
2026.05-rc2, released May 21th, 2026
Fixes all over the tree.
Updated/fixed packages: bind, cog, exim, fwts, gnupg2,
haveged, htop, imagemagick, intel-microcode, libabseil-cpp,
libargon2, libblockdev, libde265, libgphoto2, libheif, libks,
libmodsecurity, libnfs, libnss, liburiparser, libvncserver,
memcached, mongoose, mpd, openvmtools, postgresql,
python-cbor2, python-google-api-core,
python-sdbus-modemmanager, rsync, samba4, sed,
shadowsocks-libev, supertux, tzdata, weston, wireshark,
wpewebkit, zic, zlib-ng
2026.05-rc1, released May 12th, 2026
Fixes all over the tree and new features.
Architecture:
- ARM Neoverse-V1/V2/V3/V3AE cores added
- Default x86 CPU variant is now i686 (from i586)
Toolchain:
- Support for Linux 7.0.x headers
- ARM external toolchains bumped to 15.2.rel1
Filesystem:
- Support for XFS rootfs generation.
Misc:
- generate-cyclonedx now adds source attribute to known
CVEs for better compatibility with Dependency-Track.
New defconfigs: AMD Versal VPK120, TI j721e starter kit (TDA4VM-SK)
New packages: cxxopts, drm-info, ftxui, go-bootstrap-stage5,
iniparser, libnss-ato, libzippp, ndctl, opendoas,
python-cloudpickle, python-deprecation,
python-farama-notifications, python-gymnasium,
python-humanfriendly, python-isodate, python-transitions,
sbctl, ugetty, zix
Removed packages: cegui, openswan, pcre, rubix, snort,
spinxbase
2026.02.3, released June 16, 2026
Important / security related fixes:
@@ -341,6 +121,7 @@
xserver_xorg-server, glibc, memcached, libmicrohttpd, supertux, exim,
python-urllib3, qt5webengine-chromium
2026.02.2, released May 20, 2026
Changes with potentially large impact:
@@ -491,6 +272,7 @@
wireless-regdb, wireshark, wolfssl, wolftpm, xdg-dbus-proxy,
xlib_libXpm, xserver_xorg-server, xwayland
2026.02.1, released April 21, 2026
Changes with potentially large impact:
@@ -582,6 +364,7 @@
python-wheel, python3, python3, quickjs, rauc, redis, sqlite, sway, tor,
uboot, uclibc, wireshark, wpebackend-fdo, xen, xz, xz, zfs
2026.02, released March 4th, 2026
Various fixes.
@@ -685,64 +468,6 @@
- How can I make the 'en_US' locale by default?
https://gitlab.com/buildroot.org/buildroot/-/issues/161
2025.11.3, released March 17, 2026
Important / security related fixes:
botan: CVE-2024-50382, CVE-2024-50383
c-ares: CVE-2025-62408
clamav: CVE-2026-20031
containerd: CVE-2024-25621, CVE-2024-40635, CVE-2025-47291,
CVE-2025-64329
cups: CVE-2025-58436, CVE-2025-61915
exiv2: CVE-2026-25884, CVE-2026-27596, CVE-2026-27631
fluidsynth: CVE-2025-56225
freerdp: CVE-2024-32661, CVE-2026-23530, CVE-2026-23531,
CVE-2026-23532, CVE-2026-23533, CVE-2026-23534, CVE-2026-23948,
CVE-2026-24675, CVE-2026-24676, CVE-2026-24679, CVE-2026-24681,
CVE-2026-24682, CVE-2026-24683
freetype: CVE-2026-23865
graphicsmagick, CVE-2025-27796
igmpproxy: CVE-2025-50681
imagemagick: CVE-2026-22770, CVE-2026-23874, CVE-2026-23876,
CVE-2026-24481, CVE-2026-25638, CVE-2026-25794, CVE-2026-25795,
CVE-2026-25796, CVE-2026-25798, CVE-2026-25799, CVE-2026-25897,
CVE-2026-25989, CVE-2026-26066, CVE-2026-26283, CVE-2026-26284,
CVE-2026-26983
jasper: CVE-2025-8836, CVE-2025-8837
libsoup3: CVE-2025-14523
libssh: CVE-2025-14821, CVE-2026-0964, CVE-2026-0965, CVE-2026-0966,
CVE-2026-0967, CVE-2026-0968
libtpms: CVE-2026-21444
mupdf: CVE-2026-25556
netsnmp: CVE-2025-68615
patch: CVE-2018-6952, CVE-2019-20633
postgresql: CVE-2026-2003, CVE-2026-2004, CVE-2026-2005, CVE-2026-2006
python-multipart: CVE-2026-24486
rtl_433: CVE-2025-34450
squid: CVE-2025-62168
tinyproxy: CVE-2025-63938
vim: CVE-2026-25749, CVE-2026-26269
wpewebkit: CVE-2025-31273, CVE-2025-31278, CVE-2025-43211,
CVE-2025-43212, CVE-2025-43216, CVE-2025-43227, CVE-2025-43228,
CVE-2025-43240, CVE-2025-43265, CVE-2025-43272, CVE-2025-43342,
CVE-2025-43343, CVE-2025-43356, CVE-2025-43368, CVE-2025-6558
Infrastructure updates/fixes:
linux: make license option visible for _CUSTOM_VERSION as well
support/testing/run-tests: fix Debian testing/unstable
Updated / fixed packages: botan, c-ares, clamav, containerd, cups,
docker, dtc, exiv2, faketime, flashbench, freerdp, freetype,
graphicsmagick, igmpproxy, imagemagick, jasper, libsoup3, libssh,
libtpms, libvips, libvirt, libzlib, mpir, mupdf, netsnmp, patch, poco,
postgresql, python3, python-multipart, qemu, rtl_433, samba4, snort,
squid, tinyproxy, util-linux, vim, webkitgtk, wireshark, wmctrl,
wpewebkit
Removed packages: qemu (cris target), python3 (ossaudiodev)
2025.11.2, released February 20, 2026
avahi: CVE-2021-3468, CVE-2023-38469, CVE-2023-38470, CVE-2023-38471,
@@ -1573,513 +1298,6 @@
- netsnmp: unexpected header length in /proc/net/snmp...
https://gitlab.com/buildroot.org/buildroot/-/issues/110
2025.02.16, released July 15, 2026
Important / security related fixes:
apache: CVE-2026-29167, CVE-2026-29170, CVE-2026-34355, CVE-2026-34356,
CVE-2026-42535, CVE-2026-42536, CVE-2026-43951, CVE-2026-44119,
CVE-2026-44185, CVE-2026-44186, CVE-2026-44631, CVE-2026-48913,
CVE-2026-49975
asterisk: GHSA-3g56-cgrh-95p5, GHSA-3rhj-hhw7-m6fw,
GHSA-4pgv-j3mr-3rcp, GHSA-589g-qgf8-m6mx, GHSA-746q-794h-cc7f,
GHSA-8jhw-m2hg-vp3h, GHSA-8jw3-ccr9-xrmf, GHSA-g8q2-p36q-94f6,
GHSA-h5hv-jmgj-92q2, GHSA-j2mm-57pq-jh94, GHSA-mxgm-8c6f-5p8f,
GHSA-ph27-3m5q-mj5m, GHSA-q9fr-m7g8-6ph5, GHSA-qf8j-jp7h-c5hx,
GHSA-r6c2-hwc2-j4mp, GHSA-vfhr-r9x9-c687, GHSA-vrfp-mg3q-3959,
GHSA-wcvv-g26m-wx5c, GHSA-x348-j6c9-77f3, GHSA-xgj6-2gc5-5x9c
avahi: CVE-2026-34933
bind: (no CVE assigned), CVE-2026-3593
cpp-httplib: CVE-2026-45352, CVE-2026-45372, CVE-2026-46527
cups-filters: CVE-2025-64503
expat: CVE-2026-50219, CVE-2026-56131, CVE-2026-56132, CVE-2026-56403,
CVE-2026-56404, CVE-2026-56405, CVE-2026-56406, CVE-2026-56407,
CVE-2026-56408, CVE-2026-56409, CVE-2026-56410, CVE-2026-56411,
CVE-2026-56412
ghostscript: (no CVE assigned)
glibc: CVE-2026-5450, CVE-2026-5928
icu: CVE-2025-5222
imagemagick: CVE-2026-48724, CVE-2026-48733, CVE-2026-48734,
CVE-2026-48994, CVE-2026-49218, CVE-2026-49219, CVE-2026-53460,
CVE-2026-53461, CVE-2026-53462, CVE-2026-53463, CVE-2026-53464,
CVE-2026-53465
jq: CVE-2026-32316, CVE-2026-33947, CVE-2026-33948, CVE-2026-39979,
CVE-2026-40164, CVE-2026-40612, CVE-2026-41256, CVE-2026-41257,
CVE-2026-43894, CVE-2026-43896, CVE-2026-44777, CVE-2026-49839,
CVE-2026-54679
libarchive: (no CVE assigned)
libcurl: CVE-2026-10536, CVE-2026-11352, CVE-2026-11564,
CVE-2026-11586, CVE-2026-11856, CVE-2026-12064, CVE-2026-8286,
CVE-2026-8458, CVE-2026-8924, CVE-2026-8925, CVE-2026-8926,
CVE-2026-8927, CVE-2026-8932, CVE-2026-9079, CVE-2026-9080,
CVE-2026-9545, CVE-2026-9546, CVE-2026-9547
libevent: (no CVE assigned)
libglib2: CVE-2025-14087
libgsasl: CVE-2026-48829
libinput: CVE-2026-50292
libopenssl: CVE-2026-34180, CVE-2026-34181, CVE-2026-34182,
CVE-2026-34183, CVE-2026-42764, CVE-2026-42766, CVE-2026-42767,
CVE-2026-42768, CVE-2026-42769, CVE-2026-42770, CVE-2026-45445,
CVE-2026-45446, CVE-2026-45447, CVE-2026-7383, CVE-2026-9076
libssh2: CVE-2026-55199, CVE-2026-55200
mariadb: CVE-2026-48163, CVE-2026-48165, CVE-2026-49261
mesa3d: CVE-2026-40393
mongoose: (no CVE assigned yet)
nginx: CVE-2026-42055, CVE-2026-48142
openjpeg: CVE-2026-6192
openvpn: CVE-2026-11771, CVE-2026-12932, CVE-2026-12996,
CVE-2026-13117, CVE-2026-13122, CVE-2026-13698
php: CVE-2026-12184, CVE-2026-14355
python-django: CVE-2026-35192, CVE-2026-35193, CVE-2026-48587,
CVE-2026-5766, CVE-2026-6873, CVE-2026-6907, CVE-2026-7666,
CVE-2026-8404
python3: CVE-2026-11940, CVE-2026-9669
redis: CVE-2026-23479, CVE-2026-23631, CVE-2026-25243
squid: CVE-2026-33515, CVE-2026-33526, CVE-2026-47729, CVE-2026-50012
sudo: CVE-2026-35535
swupdate: CVE-2026-28525
tiff: CVE-2026-36849
tor: TROVE-2026-025, TROVE-2026-026.
util-linux: CVE-2025-14104, CVE-2026-27456, CVE-2026-53612,
CVE-2026-53613, CVE-2026-53614
webkitgtk: CVE-2026-28847, CVE-2026-28883, CVE-2026-28901,
CVE-2026-28902, CVE-2026-28903, CVE-2026-28904, CVE-2026-28905,
CVE-2026-28907, CVE-2026-28942, CVE-2026-28946, CVE-2026-28947,
CVE-2026-28953, CVE-2026-28955, CVE-2026-28958, CVE-2026-43658,
CVE-2026-43660
wolfssl: CVE-2026-10097, CVE-2026-10098, CVE-2026-10512,
CVE-2026-10592, CVE-2026-11310, CVE-2026-11703, CVE-2026-11999,
CVE-2026-12340, CVE-2026-55958, CVE-2026-55960, CVE-2026-55961,
CVE-2026-55962, CVE-2026-55964, CVE-2026-55967, CVE-2026-6091,
CVE-2026-6092, CVE-2026-6094, CVE-2026-6291, CVE-2026-6325,
CVE-2026-6329, CVE-2026-6330, CVE-2026-6331, CVE-2026-6412,
CVE-2026-6450, CVE-2026-6678, CVE-2026-6681, CVE-2026-6731,
CVE-2026-7511, CVE-2026-7531, CVE-2026-7532, CVE-2026-8720
Toolchain:
- gcc: bump 14.x series to 14.4.0
- glibc, localedef: security bump to version 2.41-143-gfc7a48bc9
Infrastructure updates/fixes:
- support/testing Improve TestPythonPy3NetworkmanagerGoi
- generate-cyclonedx: fixup scp-style git sites
- support/testing: Fix test_gnupg2
- support/testing: various internal refactorings
Updated / fixed packages: apache, asterisk, avahi, bind, bind,
cpp-httplib, cpp-httplib, cups-filters, expat, gcc:, ghostscript,
glibc, hwdata, icu, imagemagick, jq, kodi-screensaver-rsxs,
libarchive, libcurl, libepoxy, libevent, libglib2, libglib2,
libglib2-bootstrap, libgsasl, libgsasl, libinput, libopenssl,
libssh2, libssh2, linux, mariadb, mdnsd, mesa3d, mongoose, mpd,
nginx, ntp, openjpeg, openrc, openvpn, php, python-django, python3,
python3, qt5, redis, rsync, ruby, shadow, shim, squid, squid, squid,
squid, strongswan, sudo, swupdate, tiff, tor, util-linux, util-linux,
util-linux, util-linux, util-linux, util-linux, webkitgtk, wolfssl
2025.02.15, released June 16, 2026
Important / security related fixes:
asterisk: GHSA-8fj4-fv9f-hjpc, GHSA-g88q-c2hm-q7p7,
GHSA-j29p-pvh2-pvqp, GHSA-x5pq-qrp4-fmrj
bind: CVE-2026-3039, CVE-2026-3592, CVE-2026-5946, CVE-2026-5950
capnproto: CVE-2026-322, CVE-2026-32239, CVE-2026-32240
cups-filters: CVE-2025-64524
dnsmasq: CVE-2026-2291, CVE-2026-4890, CVE-2026-4891, CVE-2026-4892,
CVE-2026-4893, CVE-2026-5172
dropbear: CVE-2019-6111, CVE-2026-35385
exim: (no CVE assigned), CVE-2026-48840
expat: CVE-2026-45186
freeipmi: CVE-2026-50031
glibc: CVE-2026-4046, CVE-2026-4437, CVE-2026-4438, CVE-2026-5450,
CVE-2026-5928
go: (no CVE assigned), CVE-2025-61726, CVE-2025-61728, CVE-2025-61730,
CVE-2025-61731, CVE-2025-61732, CVE-2025-68121, CVE-2025-68121,
CVE-2026-25679, CVE-2026-27137, CVE-2026-27138, CVE-2026-27139,
CVE-2026-27140, CVE-2026-27142, CVE-2026-27143, CVE-2026-27144,
CVE-2026-32280, CVE-2026-32281, CVE-2026-32283, CVE-2026-32288,
CVE-2026-32289, CVE-2026-33810, CVE-2026-33811, CVE-2026-33814,
CVE-2026-39817, CVE-2026-39819, CVE-2026-39820, CVE-2026-39823,
CVE-2026-39825, CVE-2026-39826, CVE-2026-39836, CVE-2026-42499,
CVE-2026-42501
go-bootstrap-stage5: CVE-2026-33811, CVE-2026-33814, CVE-2026-39817,
CVE-2026-39819, CVE-2026-39820, CVE-2026-39823, CVE-2026-39825,
CVE-2026-39826, CVE-2026-39836, CVE-2026-42499, CVE-2026-42501
haveged: CVE-2026-41054
imagemagick: CVE-2026-42326, CVE-2026-45031, CVE-2026-45358,
CVE-2026-45359, CVE-2026-45624, CVE-2026-45664, CVE-2026-46520,
CVE-2026-46521, CVE-2026-46522, CVE-2026-46523, CVE-2026-46557,
CVE-2026-46559
intel-microcode: CVE-2025-35979
libde265: CVE-2026-45382, CVE-2026-45383, GHSA-ccfw-29x7-rrx3,
GHSA-j2qq-x2xq-g9wr
libgpg-error: T8239
libheif: CVE-2026-32738, CVE-2026-32739, CVE-2026-32740,
CVE-2026-32741, CVE-2026-32814, CVE-2026-32882, CVE-2026-3949,
CVE-2026-41069, CVE-2026-41071, CVE-2026-47178, CVE-2026-47247,
CVE-2026-47251, CVE-2026-47254, CVE-2026-47709, CVE-2026-47714,
GHSA-5hqq-636x-r3cr, GHSA-6x5f-qchq-cxqv, GHSA-jvmp-j3cw-84mh,
GHSA-r7qj-cg5r-r6vf
libmad: CVE-2017-837, CVE-2017-8372, CVE-2017-8373, CVE-2017-8374
libmodsecurity: CVE-2026-30923, CVE-2026-42268
libssh2: CVE-2026-7598
liburiparser: CVE-2026-44927, CVE-2026-44928
libusb: CVE-2026-23679, CVE-2026-47104
libvncserver: CVE-2026-3285, CVE-2026-32853, CVE-2026-32854
linux-pam: CVE-2025-6020
mariadb: CVE-2026-34303, CVE-2026-3494, CVE-2026-44168, CVE-2026-44169,
CVE-2026-44170, CVE-2026-44171, CVE-2026-44172, CVE-2026-44173
memcached: (no CVE assigned)
nginx: CVE-2026-40460, CVE-2026-40701, CVE-2026-42926, CVE-2026-42934,
CVE-2026-42945, CVE-2026-42946, CVE-2026-9256
openssh: CVE-2025-61984, CVE-2025-61985, CVE-2026-35385,
CVE-2026-35386, CVE-2026-35387, CVE-2026-35388, CVE-2026-35414
php: CVE-2025-14179, CVE-2026-6722, CVE-2026-6735, CVE-2026-7258,
CVE-2026-7259, CVE-2026-7261, CVE-2026-7262, CVE-2026-7568
postgresql: CVE-2026-6472, CVE-2026-6473, CVE-2026-6474, CVE-2026-6475,
CVE-2026-6476, CVE-2026-6477, CVE-2026-6478, CVE-2026-6479,
CVE-2026-6575, CVE-2026-6637, CVE-2026-6638
putty: CVE-2026-48850, CVE-2026-48851, CVE-2026-48852
python-urllib3: CVE-2026-44431, CVE-2026-44432
python3: CVE-2026-3276, CVE-2026-7774, CVE-2026-8328
radvd: CVE-2026-48715
rsync: CVE-2026-29518, CVE-2026-43617, CVE-2026-43618, CVE-2026-43619,
CVE-2026-43620, CVE-2026-45232
runc: CVE-2025-31133, CVE-2025-52565, CVE-2025-52881
samba4: CVE-2026-1933, CVE-2026-2340, CVE-2026-3012, CVE-2026-3238,
CVE-2026-4408, CVE-2026-4480
sdl2_image: CVE-2026-35444
sed: CVE-2026-5958
sshfs: CVE-2026-47187, CVE-2026-48711
tor: TROVE-2026-013, TROVE-2026-014, TROVE-2026-015, TROVE-2026-016,
TROVE-2026-017, TROVE-2026-018, TROVE-2026-019, TROVE-2026-020,
TROVE-2026-021, TROVE-2026-022
unbound: CVE-2026-32792, CVE-2026-33278, CVE-2026-40622,
CVE-2026-41292, CVE-2026-42534, CVE-2026-42923, CVE-2026-42944,
CVE-2026-42959, CVE-2026-42960, CVE-2026-44390, CVE-2026-44608
unzip: CVE-2021-4217
xserver_xorg-server: (no CVE assigned)
xwayland: (no CVE assigned)
Toolchain:
- linux-headers:: bump to 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91
Infrastructure updates/fixes:
- generate-cyclonedx: generate externalReferences with
source-distribution
- Remove /usr/share/info/dir from target
- bump-stable-kernel-versions: update for split hash file
- cve-check: fix vulnerability timestamp to RFC 3339
- cve-check: remove 'bom-ref' for vulnerabilities
- generate-cyclonedx: add hashes from .hash files to externalReferences
- dependencies.sh: reject buggy uutils "install" on Ubuntu 26.04
- add 'make show-info-all'
- cve-check: fix vulnerabilities with different analysis
- kconfig: fix compiler warnings
- generate-cyclonedx: remove indirect dependencies from root component
- cve-check: add indication how to run
- generate-cyclonedx: generate vcs externalReferences for source repos
- gitlab-ci: use larger shared runners where necessary
- replicate IGNORE_CVES to host packages
- generate-cyclonedx: hint at missing Buildroot host package on a
specific error
Updated defconfigs: at91sam9x5ek*
Updated / fixed packages: libmicrohttpd, qt53d, crucible, libgit2, php,
esp-hosted, tzdata, libabseil-cpp, collectd, redis, swupdate,
libdill, zsh, samba4, haveged, arm-trusted-firmware, weston,
wireless-regdb, libssh2, go-bootstrap-stage5, jq, kodi, unbound,
lrzip, libgpg-error, hplip, expat, heimdal, glibc, go, imagemagick,
kexec, libnss, putty, libmad, vorbis-tools, libvncserver, rsync,
mongoose, intel-microcode, freeipmi, openssh, dos2unix, liburiparser,
zic, cups-filters, libks, odhcp6c, libmodsecurity, memcached,
graphene, vlc, capnproto, faad2, gcc-bare-metal, mariadb, qt6base,
python-ecdsa, runc, heirloom-mailx, icu, systemd, unzip, dnsmasq,
gst1-plugins-bad, cairo, dropbear, libusb, asterisk, hiredis,
linux-pam, sed, gstreamer1, xfsprogs, python-urllib3, radvd,
qt5webengine-chromium, sshfs, gdb, python3, sane-backends,
linux-headers:, zlib-ng, libheif, supertux, postgresql,
gst1-plugins-good, libde265, libdrm, exim, linux, lrzsz, babeld,
bind, nginx, stellarium, sdl2_image, tor, libpthsem, wpewebkit,
libargon2, xwayland, python-cbor2, xserver_xorg-server, poppler,
jemalloc
2025.02.14, released May 20, 2026
Changes with potentially large impact:
- ficl was downgraded to version 3.065 because ficl4 is no longer
maintained.
Important / security related fixes:
apache: CVE-2026-23918, CVE-2026-24072, CVE-2026-28780, CVE-2026-29168,
CVE-2026-29169, CVE-2026-33006, CVE-2026-33007, CVE-2026-33523,
CVE-2026-33857, CVE-2026-34032, CVE-2026-34059
bubblewrap: CVE-2026-41163
cups: CVE-2026-27447, CVE-2026-34978, CVE-2026-34979, CVE-2026-34980,
CVE-2026-34990, CVE-2026-39314, CVE-2026-39316, CVE-2026-41079
dash: CVE-2026-31323
dropbear: CVE-2019-6111, CVE-2026-35385
exim: CVE-2026-40684, CVE-2026-40685, CVE-2026-40686, CVE-2026-40687
expat: CVE-2026-7210, CVE-2026-41080
ffmpeg: CVE-2026-30997
freetype: CVE-2026-23865
ghostscript: (no CVE assigned)
giflib: CVE-2021-40633, CVE-2025-31344, CVE-2026-23868
gnutls: CVE-2026-33845, CVE-2026-33846, CVE-2026-3832, CVE-2026-3833,
CVE-2026-42009, CVE-2026-42010, CVE-2026-42011, CVE-2026-42012,
CVE-2026-42013, CVE-2026-42014, CVE-2026-42015, CVE-2026-5260,
CVE-2026-5419
imagemagick: CVE-2026-28493, CVE-2026-28494, CVE-2026-28686,
CVE-2026-28687, CVE-2026-28688, CVE-2026-28689, CVE-2026-28690,
CVE-2026-28691, CVE-2026-28692, CVE-2026-28693, CVE-2026-30883,
CVE-2026-30929, CVE-2026-30931, CVE-2026-30935, CVE-2026-30936,
CVE-2026-30937, CVE-2026-31853, CVE-2026-32259, CVE-2026-32636,
CVE-2026-33535, CVE-2026-33536, CVE-2026-33899, CVE-2026-33900,
CVE-2026-33901, CVE-2026-33902, CVE-2026-33905, CVE-2026-33908,
CVE-2026-34238, CVE-2026-40169, CVE-2026-40183, CVE-2026-40310,
CVE-2026-40311, CVE-2026-40312
lcms2: CVE-2026-41254, CVE-2026-42798
libcap: CVE-2026-4878
libcurl: CVE-2026-7168, CVE-2026-7009, CVE-2026-6429, CVE-2026-6276,
CVE-2026-6253, CVE-2026-5773, CVE-2026-5545, CVE-2026-4873
libexif: CVE-2026-40386, CVE-2026-40385, CVE-2026-32775
libjxl: CVE-2025-12474, CVE-2026-1837
libmicrohttpd: (no CVE assigned)
libpcap: CVE-2025-11961
libpjsip: CVE-2026-25994, CVE-2026-26203, CVE-2026-26967,
CVE-2026-29068, CVE-2026-28799, CVE-2026-32942, CVE-2026-32945,
CVE-2026-33069, CVE-2026-34235, CVE-2026-40614, CVE-2026-40892,
CVE-2026-41416, CVE-2026-41415, CVE-2026-42225, CVE-2025-65102
libspdm: GHSA-m4wc-xmvg-369f, GHSA-j54w-759w-xj3m
liburiparser: CVE-2026-42371
libxml2: CVE-2026-6732
log4cxx: CVE-2025-54812, CVE-2025-54813, CVE-2026-40023
mbedtls: CVE-2025-66442, CVE-2026-25833, CVE-2026-25834,
CVE-2026-25835, CVE-2026-34871, CVE-2026-34872, CVE-2026-34873,
CVE-2026-34874, CVE-2026-34875, CVE-2026-34876, CVE-2026-34877
musl: CVE-2026-6042, CVE-2026-40200
nginx: CVE-2026-27654, CVE-2026-27784, CVE-2026-32647, CVE-2026-27651,
CVE-2026-28753, CVE-2026-28755, CVE-2025-53859, CVE-2025-23419,
CVE-2024-7347, CVE-2024-32760, CVE-2024-31079, CVE-2024-35200,
CVE-2024-34161
opensc: CVE-2025-13763, CVE-2025-49010, CVE-2025-66215, CVE-2025-66038,
CVE-2025-66037
openvpn: CVE-2026-40215, CVE-2026-35058
p11-kit: CVE-2026-2100
p7zip: CVE-2021-3520
proftpd: CVE-2026-42167
python-cbor2: CVE-2026-26209, CVE-2025-64076, CVE-2025-68131
python-django: CVE-2026-3902, CVE-2026-4277, CVE-2026-4292,
CVE-2026-33033, CVE-2026-33034
python-pyasn1: CVE-2026-30922
python-pyopenssl: CVE-2026-27448, CVE-2026-27459
python-requests: CVE-2026-25645
python3: CVE-2024-6923, CVE-2025-13836, CVE-2025-59375
rsync: (no CVE assigned)
ruby: CVE-2026-41316
sqlite: CVE-2025-70873
strongswan: CVE-2026-25075
systemd: CVE-2026-40226
thrift: CVE-2025-48431, CVE-2026-41602, CVE-2026-41603, CVE-2026-41604,
CVE-2026-41605, CVE-2026-41606, CVE-2026-41607, CVE-2026-41636,
CVE-2026-43868, CVE-2026-43869, CVE-2026-43870
tor: CVE-2026-44597, CVE-2026-44599, CVE-2026-44600, CVE-2026-44601,
CVE-2026-44602, CVE-2026-44603
util-linux: CVE-2026-27456
webkitgtk: CVE-2026-20643, CVE-2026-20664, CVE-2026-20665,
CVE-2026-20691, CVE-2026-28857, CVE-2026-28859, CVE-2026-28861,
CVE-2026-28871, CVE-2025-43457, CVE-2025-46299, CVE-2026-20608,
CVE-2026-20635, CVE-2026-20636, CVE-2026-20644, CVE-2026-20652,
CVE-2026-20676
wolfssl: CVE-2026-5264, CVE-2026-5263, CVE-2026-5295, CVE-2026-5466,
CVE-2026-5477, CVE-2026-5447, CVE-2026-5500, CVE-2026-5501,
CVE-2026-5503, CVE-2026-5187, CVE-2026-5188, CVE-2026-5448,
CVE-2026-5772, CVE-2026-5778, CVE-2026-3548, CVE-2026-3549,
CVE-2026-3547, CVE-2026-0819, CVE-2026-1005, CVE-2026-2645,
CVE-2026-3230, CVE-2025-12888, CVE-2025-11936, CVE-2025-11935,
CVE-2025-11934, CVE-2025-11933, CVE-2025-11931, CVE-2025-11932,
CVE-2025-12889, CVE-2025-13912, CVE-2025-7395, CVE-2025-7394,
CVE-2025-7396
wolftpm: CVE-2025-7844
xlib_libXpm: CVE-2026-4367
xserver_xorg-server: CVE-2026-33999, CVE-2026-34000, CVE-2026-34001,
CVE-2026-34002, CVE-2026-34003
xwayland: CVE-2026-33999, CVE-2026-34000, CVE-2026-34001,
CVE-2026-34002, CVE-2026-34003
xz: CVE-2025-31115, CVE-2026-34743
Toolchain:
- gcc: fix GCC 12, 13 and 14 build with host gcc 16, bump 12.x series
to 12.5.0
- linux-headers: bump to 6.12.90, 6.6.140, 6.1.173, 5.15.207, 5.10.256
Infrastructure updates/fixes:
- Various improvements to pkg-stats.
New packages: libxmlsec1
Updated / fixed packages: apache, btrfs-progs, bubblewrap, c-icap,
ca-certificates, cmake, cups, dash, dropbear, exim, expat, ffmpeg,
ficl, freetype, frr, gcc, ghostscript, giflib, gnutls, haproxy,
imagemagick, initscripts, kmod, lcms2, libarchive, libcap, libcurl,
libexif, libinput, libjxl, libmicrohttpd, libpcap, libpjsip, libpng,
libsodium, libspdm, liburiparser, libxml2, linux, linux-headers,
log4cxx, mbedtls, mkpasswd, musl, mutt, neon, netsnmp,
network-manager, nginx, opensc, openssh, openvpn, p11-kit, p7zip,
proftpd, python-cbor2, python-certifi, python-django,
python-magic-wormhole, python-pyasn1, python-pyopenssl,
python-requests, python3, rsync, ruby, sqlite, strongswan, sudo,
systemd, thrift, tor, util-linux, watchdogd, webkitgtk,
wireless-regdb, wolfssl, wolftpm, xdg-dbus-proxy, xlib_libXpm,
xserver_xorg-server, xwayland, xz
2025.02.13, released April 21, 2026
Changes with potentially large impact:
- openssl was updated to 3.5.0 which has a few incompatible changes.
See https://github.com/openssl/openssl/releases/tag/openssl-3.5.0
Important / security related fixes:
asterisk: CVE-2026-23739, CVE-2026-23741, CVE-2026-23738,
CVE-2026-23740
bind: https://gitlab.isc.org/isc-projects/bind9/-/issues/5751,
CVE-2026-1519, https://gitlab.isc.org/isc-
projects/bind9/-/issues/5817, https://gitlab.isc.org/isc-
projects/bind9/-/issues/5800, https://gitlab.isc.org/isc-
projects/bind9/-/issues/5826
cpp-httplib: CVE-2026-33745, CVE-2026-34441, CVE-2026-21428,
CVE-2026-22776, CVE-2026-28434, CVE-2026-28435, CVE-2026-29076,
CVE-2026-31870, CVE-2026-32627
expat: CVE-2026-32776, CVE-2026-32777, CVE-2026-32778
gpsd: CVE-2025-67268, CVE-2025-67269
libarchive: [no CVE tracking]
libcurl: CVE-2026-3805, CVE-2026-3784, CVE-2026-3783, CVE-2026-1965
libde265: CVE-2026-33164, CVE-2026-33165
libheif: CVE-2025-68431
libmicrohttpd: CVE-2025-59777, CVE-2025-62689
libopenssl: CVE-2025-9230, CVE-2025-9231, CVE-2025-9232, CVE-2025-4575,
CVE-2025-11187, CVE-2025-15467, CVE-2025-15468, CVE-2025-15469,
CVE-2025-66199, CVE-2025-68160, CVE-2025-69418, CVE-2025-69419,
CVE-2025-69420, CVE-2025-69421, CVE-2026-22795, CVE-2026-22796,
CVE-2026-31790, CVE-2026-2673, CVE-2026-28387, CVE-2026-28388,
CVE-2026-28389, CVE-2026-28390, CVE-2026-31789
libpng: CVE-2026-33416, CVE-2026-33636, CVE-2026-34757,
GHSA-6fr7-g8h7-v645
libxml2: CVE-2026-1757, CVE-2026-0990, CVE-2026-0992, CVE-2025-10911,
CVE-2026-0989
mongoose: CVE-2025-65502
musl: CVE-2025-26519
nfs-utils: CVE-2025-12801
nghttp2: CVE-2026-27135
perl: CVE-2026-4176
python-django: CVE-2026-25673, CVE-2026-25674
python-flask: CVE-2026-27205
python-pyasn1: CVE-2026-23490
python-pyjwt: CVE-2026-32597, GHSA-752w-5fwx-jx9f
python-tornado: CVE-2025-67724, CVE-2025-67725, CVE-2025-67726
python-wheel: CVE-2026-24049
quickjs: CVE-2025-62490, CVE-2025-62491, CVE-2025-62492,
CVE-2025-62493, CVE-2025-62494, CVE-2025-62495, CVE-2025-62496
rauc: CVE-2026-34155
redis: [No CVE tracking]
ruby: CVE-2025-27221, CVE-2025-58767, CVE-2025-61594, CVE-2026-27820
tor: TROVE-2026-003, TROVE-2026-004
wireshark: CVE-2025-11626
Toolchain:
- uclibc: bump to 1.0.57
- musl: bump to 1.2.6
- linux-headers: bump to 6.12.81, 6.6.134, 6.1.168, 5.15.202, 5.10.252
Infrastructure updates/fixes:
- Add SECURITY.md
- Automatically add 2025.02.x prefix for b4 users
- generate-cyclonedx: add source attribute with NVD reference for CVEs
- Fix cve-check's CVE URLs
- New runtime test for connman.
- Added support for "secondary" target that are less often tested in
autobuilders
- New runtime test for memcached
- Fix error handling in br2-external
Updated defconfigs: aarch64_efi, nitrogen*
Updated / fixed packages: asterisk, bind, cpp-httplib, expat, faketime,
freeradius-server, giflib, gpsd, ibm-sw-tpm2, leafnode2, libarchive,
libcurl, libde265, libftdi1, libheif, libmicrohttpd, libopenssl, libpng,
libspdm, libxml2, linux, linux-headers, ltp-testsuite, luvi, mongoose,
mpd, musl, nfs-utils, nghttp2, perl, python-djange, python-flask,
python-pyasn1, python-pyjwt, python-tornado, quickjs, rauc, redis, ruby,
sway, tor, uboot, uclibc, wireshark, zfs
2025.02.12, released March 17, 2026
Important / security related fixes:
botan: CVE-2024-50382, CVE-2024-50383
c-ares: CVE-2025-62408
containerd: CVE-2024-25621, CVE-2024-40635, CVE-2025-47291,
CVE-2025-64329
cups: CVE-2025-58436, CVE-2025-61915
exiv2: CVE-2026-25884, CVE-2026-27596, CVE-2026-27631
fluidsynth: CVE-2025-56225
freerdp: CVE-2024-32661, CVE-2026-23530, CVE-2026-23531,
CVE-2026-23532, CVE-2026-23533, CVE-2026-23534, CVE-2026-23948,
CVE-2026-24675, CVE-2026-24676, CVE-2026-24679, CVE-2026-24681,
CVE-2026-24682, CVE-2026-24683
graphicsmagick, CVE-2025-27796
igmpproxy: CVE-2025-50681
imagemagick: CVE-2026-22770, CVE-2026-23874, CVE-2026-23876,
CVE-2026-24481, CVE-2026-25638, CVE-2026-25794, CVE-2026-25795,
CVE-2026-25796, CVE-2026-25798, CVE-2026-25799, CVE-2026-25897,
CVE-2026-25989, CVE-2026-26066, CVE-2026-26283, CVE-2026-26284,
CVE-2026-26983
jasper: CVE-2025-8836, CVE-2025-8837
libsoup3: CVE-2025-14523
libssh: CVE-2025-14821, CVE-2026-0964, CVE-2026-0965, CVE-2026-0966,
CVE-2026-0967, CVE-2026-0968
libtpms: CVE-2026-21444
mupdf: CVE-2026-25556
netsnmp: CVE-2025-68615
patch: CVE-2018-6952, CVE-2019-20633
postgresql: CVE-2026-2003, CVE-2026-2004, CVE-2026-2005, CVE-2026-2006
rtl_433: CVE-2025-34450
squid: CVE-2025-62168
tinyproxy: CVE-2025-63938
vim: CVE-2026-25749, CVE-2026-26269
wpewebkit: CVE-2025-31273, CVE-2025-31278, CVE-2025-43211,
CVE-2025-43212, CVE-2025-43216, CVE-2025-43227, CVE-2025-43228,
CVE-2025-43240, CVE-2025-43265, CVE-2025-43272, CVE-2025-43342,
CVE-2025-43343, CVE-2025-43356, CVE-2025-43368, CVE-2025-6558
Infrastructure updates/fixes:
linux: make license option visible for _CUSTOM_VERSION as well
support/testing/run-tests: fix Debian testing/unstable
Updated / fixed packages: botan, c-ares, containerd, cups, dtc, exiv2,
faketime, flashbench, fluidsynth, freerdp, graphicsmagick, igmpproxy,
imagemagick, jasper, libsoup3, libssh, libtpms, libvips, libvirt,
libzlib, mupdf, netsnmp, patch, poco, postgresql, python-multipart,
qemu, rtl_433, squid, tinyproxy, util-linux, vim, webkitgtk, wmctrl,
wpewebkit
Removed packages: qemu (cris target)
2025.02.11, released February 20, 2026
avahi: CVE-2021-3468, CVE-2023-38469, CVE-2023-38470, CVE-2023-38471,

View File

@@ -101,6 +101,11 @@ config BR2_HOST_GCC_AT_LEAST_15
# When adding new entries above, be sure to update
# the HOSTCC_MAX_VERSION variable in the Makefile.
# Hidden boolean selected by packages in need of Java in order to build
# (example: kodi)
config BR2_NEEDS_HOST_JAVA
bool
# Hidden boolean selected by pre-built packages for x86, when they
# need to run on x86-64 machines (example: pre-built external
# toolchains, binary tools, etc.).

View File

@@ -144,199 +144,7 @@ endif
###############################################################################
comment "Legacy options removed in 2026.08"
config BR2_PACKAGE_TS4900_FPGA
bool "ts4900-fpga removed"
select BR2_LEGACY
help
The ts4900 defconfig was removed, so ts4900-fpga package
has been dropped.
config BR2_GDB_VERSION_14
bool "gdb 14.x has been removed"
select BR2_LEGACY
help
GDB 14.x support has been removed, a newer version should be
used instead.
config BR2_PACKAGE_ARGPARSE
bool "argparse has been removed"
select BR2_LEGACY
select BR2_PACKAGE_LUA_ARGPARSE
help
Package argparse duplicates the package lua-argparse.
config BR2_KERNEL_HEADERS_7_0
bool "kernel headers version 7.0.x are no longer supported"
select BR2_LEGACY
help
Version 7.0.x of the Linux kernel headers are no longer
maintained upstream and are now removed.
config BR2_PACKAGE_BLUEZ5_UTILS_PLUGINS_SAP
bool "bluez sap plugin removed"
select BR2_LEGACY
help
Build plugin for SAP profile.
config BR2_PACKAGE_BLUEZ5_UTILS_PLUGINS_HEALTH
bool "bluez health plugin removed"
select BR2_LEGACY
help
Build plugin for health profiles.
config BR2_GCC_VERSION_13_X
bool "gcc 13.x support removed"
select BR2_LEGACY
help
Support for building a toolchain based on GCC 13.x has been
removed, chose a newer GCC version instead.
config BR2_PACKAGE_QEMU_TARGET_MICROBLAZEEL
bool "qemu target microblazeel removed"
select BR2_PACKAGE_QEMU_TARGET_MICROBLAZE
select BR2_LEGACY
help
Version 11.0.0 of qemu folded microblazeel support into
the microblaze target.
comment "Legacy options removed in 2026.05"
config BR2_PACKAGE_PTPD2
bool "ptpd2 removed"
select BR2_LEGACY
help
ptpd2 was no longer maintained upstream, so it has been
dropped.
config BR2_PACKAGE_LIBHDHOMERUN
bool "libhdhomerun"
select BR2_LEGACY
help
libhdhomerun was removed from Buildroot as it was
insufficiently maintained. It can be re-added if someone
volunteers to maintain it.
config BR2_PACKAGE_KODI_PVR_HDHOMERUN
bool "kodi-pvr-hdhomerun"
select BR2_LEGACY
help
kodi-pvr-hdhomerun was removed from Buildroot as it was
insufficiently maintained. It can be re-added if someone
volunteers to maintain it.
config BR2_PACKAGE_ZEEK
bool "zeek removed"
select BR2_LEGACY
help
The zeek package was not maintained, with numerous build
issues and severely lagging behind upstream. so it has been
dropped.
config BR2_PACKAGE_PIGPIO
bool "pigpio removed"
select BR2_LEGACY
help
pigpio was no longer maintained upstream, so it has been
dropped.
config BR2_PACKAGE_XML_SECURITY_C
bool "xml-security-c removed"
select BR2_LEGACY
help
xml-security-c was no longer maintained upstream, so it has
been dropped.
config BR2_PACKAGE_LIBPHIDGET
bool "libphidget"
select BR2_LEGACY
help
libphidget was removed from Buildroot as it was
insufficiently maintained. It can be re-added if someone
volunteers to maintain it.
config BR2_PACKAGE_PHIDGETWEBSERVICE
bool "phidgetwebservice"
select BR2_LEGACY
help
phidgetwebservice was removed from Buildroot as it was
insufficiently maintained. It can be re-added if someone
volunteers to maintain it.
config BR2_PACKAGE_DAQ
bool "daq removed"
select BR2_LEGACY
help
The only dependee, snort, has been removed. Look at daq3
for an alternative.
config BR2_PACKAGE_FWTS_EFI_RUNTIME_MODULE
bool "fwts efi_runtime kernel module removed"
select BR2_LEGACY
help
The fwts efi_runtime module has been removed in V26.01.00.
The Kernel efi_test (Kernel CONFIG_EFI_TEST) should be used
instead.
config BR2_KERNEL_HEADERS_6_19
bool "kernel headers version 6.19.x are no longer supported"
select BR2_LEGACY
help
Version 6.19.x of the Linux kernel headers are no longer
maintained upstream and are now removed.
config BR2_PACKAGE_PCRE
bool "pcre removed"
select BR2_LEGACY
help
pcre was no longer maintained upstream, so it has been
dropped. Look at pcre2 for an alternative.
config BR2_PACKAGE_SNORT
bool "snort removed"
select BR2_LEGACY
help
snort was no longer maintained upstream, so it has been
dropped. Look at snort3 for an alternative.
config BR2_PACKAGE_CEGUI
bool "cegui"
select BR2_LEGACY
help
cegui was removed from Buildroot as it was insufficiently
maintained. It can be re-added if someone volunteers to
maintain it.
config BR2_PACKAGE_SPHINXBASE
bool "sphinxbase removed"
select BR2_LEGACY
help
sphinxbase was no longer maintained upstream, so it has
been dropped.
config BR2_PACKAGE_OPENSWAN
bool "openswan removed"
select BR2_LEGACY
help
Openswan was no longer maintained upstream, so it has
been dropped.
config BR2_PACKAGE_RUBIX
bool "rubix removed"
select BR2_LEGACY
help
Rubix was no longer maintained upstream, so it has
been dropped.
config BR2_PACKAGE_LLAMA_CPP_SERVER
bool "llama-cpp option removed"
select BR2_PACKAGE_LLAMA_CPP_TOOLS
select BR2_LEGACY
help
Several tools (server, cli) now require building both
tools and server, so enable both with the same config
BR2_PACKAGE_LLAMA_CPP_TOOLS
comment "Legacy options removed in 2026.02.1"
config BR2_PACKAGE_PYTHON3_OSSAUDIODEV
bool "python3 ossaudiodev module removed"
@@ -344,27 +152,6 @@ config BR2_PACKAGE_PYTHON3_OSSAUDIODEV
help
The ossaudiodev module was removed in Python 3.13.
config BR2_TARGET_EDK2_PLATFORM_OVMF_I386
bool "EDK2 OVMF IA32 removed"
select BR2_LEGACY
help
EDK2 OVMF IA32 support was removed in upstream version
202511, so it has been dropped.
config BR2_BINUTILS_VERSION_2_43_X
bool "binutils 2.43 has been removed"
select BR2_LEGACY
help
binutils 2.43 has been removed, select a newer version
instead.
config BR2_parisc10
bool "PA-RISC architecture version 1.0 support removed"
select BR2_LEGACY
help
Following the build issues with glibc 2.43, Buildroot has
removed support for this architecture version.
comment "Legacy options removed in 2026.02"
config BR2_PACKAGE_QEMU_TARGET_CRIS
@@ -3685,12 +3472,12 @@ config BR2_PACKAGE_KODI_LIBTHEORA
Kodi does not need libtheora
config BR2_PACKAGE_CEGUI06
bool "BR2_PACKAGE_CEGUI06 was removed"
bool "BR2_PACKAGE_CEGUI06 was renamed"
select BR2_PACKAGE_CEGUI
select BR2_LEGACY
help
cegui06 was removed from Buildroot as it was insufficiently
maintained. It can be re-added if someone volunteers to
maintain it.
The BR2_PACKAGE_CEGUI06 config symbol was renamed to
BR2_PACKAGE_CEGUI.
config BR2_GCC_VERSION_5_X
bool "gcc 5.x support removed"

View File

@@ -166,9 +166,6 @@ F: configs/hifive_unleashed_defconfig
F: package/libspdm/
F: package/xen/
N: Alsey Coleman Miller <alseycmiller@gmail.com>
F: package/liblc3/
N: Alvaro G. M <alvaro.gamez@hazent.com>
F: package/dcron/
F: package/libxmlrpc/
@@ -189,7 +186,6 @@ F: package/wine/
N: Andrea Ricchi <andrea.ricchi@amarulasolutions.com>
F: package/cutekeyboard/
F: package/libcppconnman/
N: Andreas Klinger <ak@it-klinger.de>
F: package/ply/
@@ -247,7 +243,6 @@ F: package/python-pillow/
F: package/python-pydal/
F: package/python-spidev/
F: package/python-web2py/
F: package/qpdf/
F: package/qt5/qt5coap/
F: package/qt5/qt5knx/
F: package/qt5/qt5mqtt/
@@ -374,7 +369,6 @@ F: package/bcg729/
F: package/bento4/
F: package/bitcoin/
F: package/clamav/
F: package/cxxopts/
F: package/dav1d/
F: package/dht/
F: package/dnsmasq/
@@ -432,6 +426,7 @@ F: package/libfribidi/
F: package/libg7221/
F: package/libglew/
F: package/libglu/
F: package/libhdhomerun/
F: package/libheif/
F: package/libid3tag/
F: package/libilbc/
@@ -450,7 +445,6 @@ F: package/libsidplay2/
F: package/libsilk/
F: package/libsndfile/
F: package/libsoundtouch/
F: package/libudev-zero/
F: package/libudfread/
F: package/libunibreak/
F: package/liburiparser/
@@ -463,7 +457,6 @@ F: package/libvorbis/
F: package/libvpl/
F: package/libvpx/
F: package/libyuv/
F: package/libzippp/
F: package/linux-firmware/
F: package/mc/
F: package/mesa3d/
@@ -519,7 +512,6 @@ F: package/python-pyicu/
F: package/python-pylru/
F: package/python-requests-oauthlib/
F: package/python-slob/
F: package/qt6/qt6positioning/
F: package/rrdtool/
F: package/rsync/
F: package/rtmpdump/
@@ -537,14 +529,12 @@ F: package/unixodbc/
F: package/utfcpp/
F: package/vlc/
F: package/wget/
F: package/wget2/
F: package/wireless-regdb/
F: package/wireless_tools/
F: package/x264/
F: package/x265/
F: package/xmrig/
F: package/ytree/
F: package/zix/
F: package/znc/
F: support/testing/tests/package/test_perl_html_parser.py
@@ -620,10 +610,6 @@ F: package/alsa-plugins/
N: Changming Huang <jerry.huang@nxp.com>
F: package/qoriq-cadence-dp-firmware/
N: Chen Pei <cp0613@linux.alibaba.com>
F: package/iniparser/
F: package/ndctl/
N: Chris Packham <judge.packham@gmail.com>
F: package/coremark/
F: package/coremark-pro/
@@ -710,9 +696,6 @@ F: package/perl-sys-mmap/
F: package/perl-time-parsedate/
F: package/perl-x10/
N: Christopher Obbard <obbardc@gmail.com>
F: package/dtui/
N: Colin Foster <colin.foster@in-advantage.com>
F: package/python-tftpy/
F: package/rauc-hawkbit-updater/
@@ -1112,6 +1095,7 @@ F: package/tinycbor/
F: package/tinydtls/
F: package/whois/
F: package/x11r7/xlib_libXpresent/
F: package/zeek/
N: Fabrice Goucem <fabrice.goucem@oss.nxp.com>
F: board/freescale/imx6ullevk/
@@ -1149,7 +1133,6 @@ F: package/cpulimit/
N: Florian Larysch <fl@n621.de>
F: package/casync-nano/
F: package/sigsum-c/
F: package/sigsum-go/
N: Floris Bos <bos@je-eigen-domein.nl>
@@ -1174,7 +1157,7 @@ F: board/visionfive2/
F: configs/sipeed_licheepi_nano_defconfig
F: configs/visionfive2_defconfig
N: Francois Perrad <francois.perrad.86@gmail.com>
N: Francois Perrad <francois.perrad@gadz.org>
F: board/olimex/a20_olinuxino
F: board/olimex/imx233_olinuxino/
F: board/olimex/stmp1_olinuxino/
@@ -1188,9 +1171,7 @@ F: package/copas/
F: package/coxpcall/
F: package/dado/
F: package/ficl/
F: package/hare*
F: package/janet/
F: package/qbe/
F: package/libtomcrypt/
F: package/libtommath/
F: package/linenoise/
@@ -1204,14 +1185,11 @@ F: package/lua*
F: package/lynis/
F: package/lzlib/
F: package/moarvm/
F: package/opendoas/
F: package/perl*
F: package/pkg-hare.mk
F: package/pkg-perl.mk
F: package/pkg-luarocks.mk
F: package/quickjs/
F: package/rings/
F: package/scdoc/
F: package/wsapi/
F: package/wsapi-fcgi/
F: package/wsapi-xavante/
@@ -1271,7 +1249,6 @@ F: package/cctz/
F: package/clpeak/
F: package/faad2/
F: package/fdk-aac/
F: package/ftxui/
F: package/httping/
F: package/iozone/
F: package/leptonica/
@@ -1371,6 +1348,7 @@ F: fs/f2fs/
F: package/bluez5_utils-headers/
F: package/f2fs-tools/
F: package/graphicsmagick/
F: package/pigpio/
F: package/python-aioblescan/
F: package/python-bluezero/
F: package/python-crontab/
@@ -1673,7 +1651,6 @@ F: package/ssdp-responder/
F: package/sysklogd/
F: package/uredir/
F: package/watchdogd/
F: support/testing/tests/package/test_mdnsd.py
N: Jochen Baltes <jochen.baltes@gmail.com>
F: package/altera-stapl
@@ -1736,7 +1713,10 @@ N: Jonathan Ben Avraham <yba@tkos.co.il>
F: arch/Config.in.xtensa
F: package/autofs/
F: package/dawgdic/
F: package/libphidget/
F: package/phidgetwebservice/
F: package/rapidxml/
F: package/sphinxbase/
N: Joris Offouga <offougajoris@gmail.com>
F: package/python-colorlog/
@@ -1762,7 +1742,6 @@ F: package/llama-cpp/
F: package/llvm-project/clang/
F: package/llvm-project/lld/
F: package/llvm-project/llvm/
F: package/mesa3d/
F: package/python-cython/
F: package/python-pycups/
F: package/python-raven/
@@ -1773,8 +1752,6 @@ F: package/python-xlib/
F: package/sentry-cli/
F: package/sentry-native/
F: package/unclutter-xfixes/
F: package/virglrenderer/
F: support/testing/tests/package/test_virglrenderer.py
N: Joshua Henderson <joshua.henderson@microchip.com>
F: package/qt5/qt5wayland/
@@ -1855,8 +1832,6 @@ F: support/testing/tests/fs/test_btrfs.py
F: support/testing/tests/fs/test_btrfs/
F: support/testing/tests/fs/test_erofs.py
F: support/testing/tests/fs/test_erofs/
F: support/testing/tests/fs/test_xfs.py
F: support/testing/tests/fs/test_xfs/
F: support/testing/tests/package/sample_python_distro.py
F: support/testing/tests/package/sample_python_gnupg.py
F: support/testing/tests/package/sample_python_hwdata.py
@@ -1864,7 +1839,6 @@ F: support/testing/tests/package/sample_python_midiutil.py
F: support/testing/tests/package/sample_python_ml_dtypes.py
F: support/testing/tests/package/sample_python_mpmath.py
F: support/testing/tests/package/sample_python_pyalsa.py
F: support/testing/tests/package/sample_python_pydal.py
F: support/testing/tests/package/sample_python_spake2.py
F: support/testing/tests/package/sample_python_sympy.py
F: support/testing/tests/package/test_4th.py
@@ -1908,7 +1882,6 @@ F: support/testing/tests/package/test_fluidsynth.py
F: support/testing/tests/package/test_fluidsynth/
F: support/testing/tests/package/test_fping.py
F: support/testing/tests/package/test_fwts.py
F: support/testing/tests/package/test_fwts/
F: support/testing/tests/package/test_gawk.py
F: support/testing/tests/package/test_ghostscript.py
F: support/testing/tests/package/test_ghostscript/
@@ -1923,8 +1896,6 @@ F: support/testing/tests/package/test_gnuradio/
F: support/testing/tests/package/test_gpsd.py
F: support/testing/tests/package/test_gpsd/
F: support/testing/tests/package/test_gstreamer1.py
F: support/testing/tests/package/test_guile.py
F: support/testing/tests/package/test_guile/
F: support/testing/tests/package/test_gzip.py
F: support/testing/tests/package/test_highway.py
F: support/testing/tests/package/test_hwloc.py
@@ -1952,8 +1923,6 @@ F: support/testing/tests/package/test_libcamera.py
F: support/testing/tests/package/test_libcamera/
F: support/testing/tests/package/test_libcurl.py
F: support/testing/tests/package/test_libgpgme.py
F: support/testing/tests/package/test_libgpiod2.py
F: support/testing/tests/package/test_libgpiod2/
F: support/testing/tests/package/test_libjxl.py
F: support/testing/tests/package/test_lighttpd.py
F: support/testing/tests/package/test_links.py
@@ -1987,8 +1956,6 @@ F: support/testing/tests/package/test_nftables.py
F: support/testing/tests/package/test_nftables/
F: support/testing/tests/package/test_ngrep.py
F: support/testing/tests/package/test_nmap.py
F: support/testing/tests/package/test_ndctl.py
F: support/testing/tests/package/test_ndctl/
F: support/testing/tests/package/test_ntp.py
F: support/testing/tests/package/test_ntp/
F: support/testing/tests/package/test_numactl.py
@@ -2003,8 +1970,6 @@ F: support/testing/tests/package/test_patch.py
F: support/testing/tests/package/test_patch/
F: support/testing/tests/package/test_pciutils.py
F: support/testing/tests/package/test_perftest.py
F: support/testing/tests/package/test_php.py
F: support/testing/tests/package/test_php/
F: support/testing/tests/package/test_pigz.py
F: support/testing/tests/package/test_postgresql.py
F: support/testing/tests/package/test_pppd.py
@@ -2020,7 +1985,6 @@ F: support/testing/tests/package/test_python_midiutil.py
F: support/testing/tests/package/test_python_ml_dtypes.py
F: support/testing/tests/package/test_python_mpmath.py
F: support/testing/tests/package/test_python_pyalsa.py
F: support/testing/tests/package/test_python_pydal.py
F: support/testing/tests/package/test_python_pyqt5.py
F: support/testing/tests/package/test_python_pyqt5/
F: support/testing/tests/package/test_python_spake2.py
@@ -2120,7 +2084,6 @@ F: board/octavo/osd32mp1-brk/
F: board/octavo/osd32mp1-red/
F: configs/octavo_osd32mp1_brk_defconfig
F: configs/octavo_osd32mp1_red_defconfig
F: package/drm-info/
N: Kris Bahnsen <kris@embeddedTS.com>
F: package/wilc-firmware/
@@ -2263,10 +2226,10 @@ F: board/orangepi/orangepi-zero3/
F: configs/grinn_*
F: configs/orangepi_zero_plus_defconfig
F: configs/orangepi_zero3_defconfig
F: package/argparse/
F: package/dt-utils/
F: package/easydbus/
F: package/gitlab-runner/
F: package/lua-argparse/
F: package/lua-flu/
F: package/lua-stdlib/
F: package/luaossl/
@@ -2290,8 +2253,6 @@ F: support/testing/tests/package/sample_python_dbus_fast.py
F: support/testing/tests/package/sample_python_dbus_next.py
F: support/testing/tests/package/sample_python_pytest.py
F: support/testing/tests/package/sample_python_pytest_asyncio.py
F: support/testing/tests/package/test_easydbus.py
F: support/testing/tests/package/test_easydbus/
F: support/testing/tests/package/test_netdata.py
F: support/testing/tests/package/test_python_dbus_next.py
F: support/testing/tests/package/test_python_pytest.py
@@ -2426,10 +2387,6 @@ F: configs/arcturus_ucls1012a_defconfig
N: Michael Fischer <mf@go-sys.de>
F: package/gnuplot/
F: package/sdl2/
F: package/sdl3/
F: package/sdl3_gfx/
F: package/sdl3_image/
F: package/sdl3_ttf/
N: Michael Nosthoff <buildroot@heine.tech>
F: package/boost/
@@ -2507,7 +2464,6 @@ F: boot/xilinx-embeddedsw/
F: boot/xilinx-prebuilt/
F: configs/versal_vck190_defconfig
F: configs/versal_vek280_defconfig
F: configs/versal_vpk120_defconfig
F: configs/versal_vpk180_defconfig
F: configs/versal2_vek385_defconfig
F: configs/zynq_zc702_defconfig
@@ -2522,8 +2478,6 @@ F: package/binutils-bare-metal/
F: package/bootgen/
F: package/gcc-bare-metal/
F: package/newlib-bare-metal/
F: package/qemu-xen/
F: package/xen/
F: package/xilinx-fpgautil/
F: toolchain/toolchain-bare-metal-buildroot/
@@ -2675,7 +2629,6 @@ F: configs/orangepi_pc_defconfig
F: configs/orangepi_r1_defconfig
F: configs/sheevaplug_defconfig
F: configs/visionfive_defconfig
F: package/agec/
F: package/bats-core/
F: package/dfu-programmer/
F: package/docker-compose/
@@ -2707,10 +2660,8 @@ F: package/rnnoise/
F: package/sedutil/
F: package/tpm2-totp/
F: package/triggerhappy/
F: package/ugetty/
F: package/wireguard-linux-compat/
F: package/wireguard-tools/
F: support/testing/tests/package/test_agec.py
F: support/testing/tests/package/test_docker_compose.py
F: support/testing/tests/package/test_python_hid.py
@@ -2801,6 +2752,10 @@ F: package/synergy/
N: Qais Yousef <qais.yousef@arm.com>
F: package/bpftrace/
N: Rafal Susz <rafal.susz@gmail.com>
F: board/avnet/s6lx9_microboard/
F: configs/s6lx9_microboard_defconfig
N: Rafał Miłecki <rafal@milecki.pl>
F: board/broadcom/northstar/
F: configs/broadcom_northstar_defconfig
@@ -3042,9 +2997,11 @@ F: package/aoetools/
F: package/asn1c/
F: package/azure-iot-sdk-c/
F: package/curlpp/
F: package/daq/
F: package/libgdiplus/
F: package/pimd/
F: package/sloci-image/
F: package/snort/
F: package/stella/
F: package/tio/
F: package/traceroute/
@@ -3055,10 +3012,6 @@ F: package/wolfssl/
N: Shubham Chakraborty <chakrabortyshubham66@gmail.com>
F: package/ccache/
F: package/dos2unix/
F: package/font-awesome/
F: package/htop/
F: package/hyperfine/
F: package/libenca/
F: package/pv/
F: package/unrar/
F: package/xterm/
@@ -3291,7 +3244,6 @@ F: support/testing/tests/package/sample_python_augeas.py
F: support/testing/tests/package/sample_python_flask.py
F: support/testing/tests/package/sample_python_flask_expects_json.py
F: support/testing/tests/package/sample_python_git.py
F: support/testing/tests/package/sample_python_pyudev.py
F: support/testing/tests/package/sample_python_unittest_xml_reporting.py
F: support/testing/tests/package/test_nodejs.py
F: support/testing/tests/package/test_python_augeas.py
@@ -3301,7 +3253,6 @@ F: support/testing/tests/package/test_python_flask_expects_json.py
F: support/testing/tests/package/test_python_fs.py
F: support/testing/tests/package/test_python_git.py
F: support/testing/tests/package/test_python_pyfatfs.py
F: support/testing/tests/package/test_python_pyudev.py
F: support/testing/tests/package/test_python_pyusb.py
F: support/testing/tests/package/test_python_serial.py
F: support/testing/tests/package/test_snagboot.py
@@ -3363,19 +3314,13 @@ F: package/rtl8822cs/
N: Victor Huesca <victor.huesca@bootlin.com>
F: support/testing/tests/core/test_root_password.py
N: Vincent Cruz <mooz@blockos.org>
F: package/python-transitions/
N: Vincent Jardin <vjardin@free.fr>
F: board/nvidia/bf3/
F: configs/nvidia_bf3_defconfig
F: package/bfscripts/
F: package/dpdk/
F: package/libecoli/
F: package/libnss-ato/
F: package/libyang-cpp/
F: package/python-libyang/
F: package/python-sysv-ipc/
F: package/sysrepo-cpp/
N: Vincent Prince <vincent.prince.fr@gmail.com>
@@ -3383,13 +3328,11 @@ F: package/nss-myhostname/
F: package/utp_com/
N: Vincent Stehlé <vincent.stehle@arm.com>
F: board/aarch64-efi/
F: board/arm/fvp-ebbr/
F: board/compulab/iot-gate-imx8-ebbr/
F: board/pine64/rockpro64-ebbr/
F: board/qemu/aarch64-ebbr/
F: board/qemu/arm-ebbr/
F: configs/aarch64_efi_defconfig
F: configs/arm_fvp_ebbr_defconfig
F: configs/iot-gate-imx8_ebbr_defconfig
F: configs/qemu_aarch64_ebbr_defconfig
@@ -3424,6 +3367,10 @@ F: support/testing/tests/package/test_zerofree.py
N: Vinicius Tinti <viniciustinti@gmail.com>
F: package/python-thrift/
N: Vivien Didelot <vivien.didelot@gmail.com>
F: board/technologic/ts5500/
F: configs/ts5500_defconfig
N: Vladimir Oltean <olteanv@gmail.com>
F: package/qoriq-ddr-phy-binary/
F: package/qoriq-firmware-inphi/
@@ -3448,11 +3395,6 @@ F: package/evilwm/
F: package/fbv/
F: package/libpam-pkcs11/
F: package/mksh/
F: package/perl-cgi/
F: package/perl-cgi-session/
F: package/perl-log-message/
F: package/perl-log-message-simple/
F: package/perl-switch/
F: package/ruby/
F: package/uclibc/
F: package/uclibc-ng-test/
@@ -3494,17 +3436,6 @@ F: boot/ti-k3-r5-loader/
F: configs/ti_am62x_sk_defconfig
F: configs/ti_am64x_sk_defconfig
N: Xukai Wang <kingxukai@zohomail.com>
F: package/python-cloudpickle/
F: package/python-farama-notifications/
F: package/python-gymnasium/
F: support/testing/tests/package/sample_python_cloudpickle.py
F: support/testing/tests/package/sample_python_farama_notifications.py
F: support/testing/tests/package/sample_python_gymnasium.py
F: support/testing/tests/package/test_python_cloudpickle.py
F: support/testing/tests/package/test_python_farama_notifications.py
F: support/testing/tests/package/test_python_gymnasium.py
N: Yair Ben Avraham <yairba@protonmail.com>
F: package/casync/
F: package/gloox/
@@ -3512,12 +3443,8 @@ F: package/tpm2-pkcs11/
N: Yann E. MORIN <yann.morin@orange.com>
F: .editorconfig
F: package/amazon-ecr-credential-helper/
F: package/docker-credential-acr-env/
F: package/docker-credential-gcr/
F: package/gpsd/
F: package/mosquitto/
F: package/python-humanfriendly/
F: package/skopeo/
N: Yegor Yefremov <yegorslists@googlemail.com>

View File

@@ -92,9 +92,9 @@ all:
.PHONY: all
# Set and export the version string
export BR2_VERSION := 2026.08-git
export BR2_VERSION := 2026.02.3
# Actual time the release is cut (for reproducible builds)
BR2_VERSION_EPOCH = 1780950000
BR2_VERSION_EPOCH = 1781643700
# Save running make version since it's clobbered by the make package
RUNNING_MAKE_VERSION := $(MAKE_VERSION)

View File

@@ -1,7 +1,5 @@
# Security Policy
[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/12245/badge)](https://www.bestpractices.dev/projects/12245)
## Security advisories
Advisories for Buildroot security vulnerabilities are reported on the

View File

@@ -344,10 +344,6 @@ config BR2_ARCH_NEEDS_GCC_AT_LEAST_16
bool
select BR2_ARCH_NEEDS_GCC_AT_LEAST_15
config BR2_ARCH_NEEDS_GCC_AT_LEAST_17
bool
select BR2_ARCH_NEEDS_GCC_AT_LEAST_16
# The following string values are defined by the individual
# Config.in.$ARCH files
config BR2_ARCH

View File

@@ -503,12 +503,6 @@ config BR2_tsv110
select BR2_ARCH_NEEDS_GCC_AT_LEAST_9
comment "armv8.4a cores"
config BR2_neoverse_v1
bool "neoverse-V1 (aka zeus)"
depends on BR2_ARCH_IS_64
select BR2_ARM_CPU_HAS_FP_ARMV8
select BR2_ARM_CPU_ARMV8A
select BR2_ARCH_NEEDS_GCC_AT_LEAST_11
config BR2_saphira
bool "saphira"
depends on BR2_ARCH_IS_64
@@ -529,12 +523,6 @@ config BR2_neoverse_n2
select BR2_ARM_CPU_HAS_FP_ARMV8
select BR2_ARM_CPU_ARMV9A
select BR2_ARCH_NEEDS_GCC_AT_LEAST_11
config BR2_neoverse_v2
bool "neoverse-V2 (aka demeter)"
depends on BR2_ARCH_IS_64
select BR2_ARM_CPU_HAS_FP_ARMV8
select BR2_ARM_CPU_ARMV9A
select BR2_ARCH_NEEDS_GCC_AT_LEAST_13
comment "armv9.2a cores"
config BR2_cortex_a720
@@ -543,18 +531,6 @@ config BR2_cortex_a720
select BR2_ARM_CPU_HAS_FP_ARMV8
select BR2_ARM_CPU_ARMV9A
select BR2_ARCH_NEEDS_GCC_AT_LEAST_14
config BR2_neoverse_v3
bool "neoverse-V3 (aka poseidon)"
depends on BR2_ARCH_IS_64
select BR2_ARM_CPU_HAS_FP_ARMV8
select BR2_ARM_CPU_ARMV9A
select BR2_ARCH_NEEDS_GCC_AT_LEAST_15
config BR2_neoverse_v3ae
bool "neoverse-V3AE (aka poseidon)"
depends on BR2_ARCH_IS_64
select BR2_ARM_CPU_HAS_FP_ARMV8
select BR2_ARM_CPU_ARMV9A
select BR2_ARCH_NEEDS_GCC_AT_LEAST_15
endchoice
config BR2_ARM_ENABLE_NEON
@@ -947,16 +923,12 @@ config BR2_GCC_TARGET_CPU
default "neoverse-n1" if BR2_neoverse_n1
default "tsv110" if BR2_tsv110
# armv8.4a
default "neoverse-v1" if BR2_neoverse_v1
default "saphira" if BR2_saphira
# armv9.0a
default "cortex-a710" if BR2_cortex_a710
default "neoverse-n2" if BR2_neoverse_n2
default "neoverse-v2" if BR2_neoverse_v2
# armv9.2a
default "cortex-a720" if BR2_cortex_a720
default "neoverse-v3" if BR2_neoverse_v3
default "neoverse-v3ae" if BR2_neoverse_v3ae
config BR2_GCC_TARGET_ABI
default "aapcs-linux" if BR2_arm || BR2_armeb

View File

@@ -3,6 +3,8 @@ choice
help
Architecture type (or version) to use.
config BR2_parisc10
bool "PA-RISC 1.0"
config BR2_parisc11
bool "PA-RISC 1.1"
endchoice

View File

@@ -23,11 +23,6 @@ choice
help
Specific CPU variant to use
config BR2_m68k_68000
bool "68000"
select BR2_m68k_m68k
select BR2_SOFT_FLOAT
config BR2_m68k_68030
bool "68030"
select BR2_m68k_m68k
@@ -46,7 +41,6 @@ config BR2_m68k_cf5208
endchoice
config BR2_GCC_TARGET_CPU
default "68000" if BR2_m68k_68000
default "68030" if BR2_m68k_68030
default "68040" if BR2_m68k_68040
default "5208" if BR2_m68k_cf5208

View File

@@ -144,16 +144,6 @@ config BR2_powerpc_power9
select BR2_POWERPC_CPU_HAS_ALTIVEC
select BR2_POWERPC_CPU_HAS_VSX
select BR2_ARCH_NEEDS_GCC_AT_LEAST_6
config BR2_powerpc_power10
bool "power10"
select BR2_POWERPC_CPU_HAS_ALTIVEC
select BR2_POWERPC_CPU_HAS_VSX
select BR2_ARCH_NEEDS_GCC_AT_LEAST_11
config BR2_powerpc_power11
bool "power11"
select BR2_POWERPC_CPU_HAS_ALTIVEC
select BR2_POWERPC_CPU_HAS_VSX
select BR2_ARCH_NEEDS_GCC_AT_LEAST_15
endchoice
config BR2_POWERPC_SOFT_FLOAT
@@ -217,8 +207,6 @@ config BR2_GCC_TARGET_CPU
default "power7" if BR2_powerpc_power7
default "power8" if BR2_powerpc_power8
default "power9" if BR2_powerpc_power9
default "power10" if BR2_powerpc_power10
default "power11" if BR2_powerpc_power11
config BR2_READELF_ARCH_NAME
default "PowerPC" if BR2_powerpc

View File

@@ -35,7 +35,7 @@ config BR2_X86_CPU_HAS_AVX512
# https://gcc.gnu.org/onlinedocs/gcc-13.2.0/gcc/x86-Options.html
choice
prompt "Target Architecture Variant"
default BR2_x86_i686 if BR2_i386
default BR2_x86_i586 if BR2_i386
depends on BR2_i386 || BR2_x86_64
help
Specific CPU variant to use

View File

@@ -4,7 +4,9 @@
ifeq ($(BR2_hppa),y)
ifeq ($(BR2_parisc11),y)
ifeq ($(BR2_parisc10),y)
GCC_TARGET_ARCH := 1.0
else ifeq ($(BR2_parisc11),y)
GCC_TARGET_ARCH := 1.1
endif

View File

@@ -24,7 +24,7 @@ image disk.img {
}
partition root {
partition-type-uuid = root-arm64
partition-type-uuid = b921b045-1df0-41c3-af44-4c6f280d3fae
image = "rootfs.ext2"
}
}

View File

@@ -1,3 +0,0 @@
CONFIG_BLK_DEV_PMEM=y
CONFIG_LIBNVDIMM=y
CONFIG_OF_PMEM=y

View File

@@ -1,2 +1,2 @@
# From https://www.kernel.org/pub/linux/kernel/v6.x/sha256sums.asc
sha256 8d1934a72a185f1be6b56e3ad8ea31fd9a381ffec0346c69f06c90d776da7cb8 linux-6.18.14.tar.xz
sha256 62148e7e17f54c4a5ab5e75ad4882682c54bee818948be61a5963234fc0849fc linux-6.11.11.tar.xz

View File

@@ -48,17 +48,6 @@ alternative to QEMU_EFI.fd. You will also need to change the machine
specification to "-M virt,secure=on" on qemu command line, to enable TrustZone
support, and you will need to increase the memory with "-m 1024".
HTTP boot
---------
Some U-Boot and Devicetree based firmwares are capable of booting with UEFI from
HTTP(s). [4]
The aarch64_efi_defconfig has appropriate persistent memory support compiled in
the Linux kernel to support this scenario. [5]
[1]: https://github.com/ARM-software/ebbr
[2]: https://developer.arm.com/architectures/system-architectures/arm-systemready
[3]: https://github.com/glikely/u-boot-tfa-build
[4]: https://docs.u-boot-project.org/en/latest/develop/uefi/uefi.html#uefi-http-boot-using-the-legacy-tcp-stack
[5]: https://github.com/ARM-software/edge-iot-arch-guide/blob/main/source/http-boot/pmem_node.md

View File

@@ -1,2 +1,2 @@
# From https://www.kernel.org/pub/linux/kernel/v6.x/sha256sums.asc
sha256 3712fc1ec839e4daac981176c8518912e8f452650aaedfe4381da4419613a431 linux-6.18.40.tar.xz
sha256 37f0c5d5c242c1d604e87d48f08795e861a5a85f725b4ca11d0a538f12ff8cff linux-6.18.8.tar.xz

View File

@@ -0,0 +1,36 @@
# Minimal SD card image for the Acmesystems Aria G25
image boot.vfat {
vfat {
file zImage {
image = "zImage"
}
file at91-ariag25.dtb {
image = "at91-ariag25.dtb"
}
file boot.bin {
image = "at91sam9x5_aria-sdcardboot-linux-zimage-dt-3.10.3.bin"
}
}
size = 16M
}
image sdcard.img {
hdimage {
}
partition boot {
partition-type = 0xC
bootable = "true"
image = "boot.vfat"
}
partition rootfs {
partition-type = 0x83
image = "rootfs.ext4"
size = 512M
}
}

View File

@@ -0,0 +1,2 @@
# Locally calculated
sha256 5ea2a8fed1ba0024229c6f6d77176679e1b24791bdbce8e285634013d4a93551 at91bootstrap3-v3.10.3-git4.tar.gz

View File

@@ -0,0 +1,2 @@
# Locally calculated
sha256 6c5e4d3c87feadbfdb9f7d2e46f3f120b00286ba380491c5956708e0b94232c8 linux-4.19.315.tar.xz

View File

@@ -0,0 +1,44 @@
Acme Systems Aria G25
Build instructions
==================
To build an image for the Aria G25 choose the configuration
corresponding to the Aria variant.
For 128MB RAM variant type:
$ make acmesystems_aria_g25_128mb_defconfig
else for 256MB RAM variant type:
$ make acmesystems_aria_g25_256mb_defconfig
To customize the configuration choosed type:
$ make menuconfig
When you are ready to start building Buildroot type:
$ make
How to write the microSD card
=============================
Once the build process is finished you will have an image called
"sdcard.img" in the output/images/ directory.
Write the bootable SD card image "sdcard.img" onto an SD card with
"dd" command:
$ sudo dd if=output/images/sdcard.img of=/dev/sdX
Assuming your Aria G25 baseboard has a MicroSD socket, for example
with the Terra baseboard, insert the microSD card into the baseboard
slot and power it.
To get the kernel log messages you can use a DPI cable
(http://www.acmesystems.it/DPI)
You can find additional informations, tutorials and a very
comprehensive documentation on http://www.acmesystems.it/aria.

View File

@@ -0,0 +1,36 @@
# Minimal SD card image for the Acmesystems Arietta G25
image boot.vfat {
vfat {
file zImage {
image = "zImage"
}
file acme-arietta.dtb {
image = "at91-ariettag25.dtb"
}
file boot.bin {
image = "at91sam9x5_arietta-sdcardboot-linux-zimage-dt-3.10.3.bin"
}
}
size = 16M
}
image sdcard.img {
hdimage {
}
partition boot {
partition-type = 0xC
bootable = "true"
image = "boot.vfat"
}
partition rootfs {
partition-type = 0x83
image = "rootfs.ext4"
size = 512M
}
}

View File

@@ -0,0 +1,2 @@
# Locally calculated
sha256 5ea2a8fed1ba0024229c6f6d77176679e1b24791bdbce8e285634013d4a93551 at91bootstrap3-v3.10.3-git4.tar.gz

View File

@@ -0,0 +1,2 @@
# Locally calculated
sha256 6c5e4d3c87feadbfdb9f7d2e46f3f120b00286ba380491c5956708e0b94232c8 linux-4.19.315.tar.xz

View File

@@ -0,0 +1,49 @@
Acme Systems Arietta G25
Intro
=====
This default configuration will allow you to start experimenting with the
buildroot environment for the Arietta G25. With the current configuration
it will bring-up the board, and allow access through the serial console.
You can find additional informations, tutorials and a very comprehensive
documentation on http://www.acmesystems.it/arietta.
Build instructions
==================
To build an image for the Arietta G25 choose the configuration
corresponding to the Arietta variant.
For 128MB RAM variant type:
$ make acmesystems_arietta_g25_128mb_defconfig
else for 256MB RAM variant type:
$ make acmesystems_arietta_g25_256mb_defconfig
To customize the configuration chosen type:
$ make menuconfig
When you are ready to start building Buildroot type:
$ make
How to write the microSD card
=============================
Once the build process is finished you will have an image called "sdcard.img"
in the output/images/ directory.
Copy the bootable "sdcard.img" onto an SD card with "dd":
$ sudo dd if=output/images/sdcard.img of=/dev/sdX
Insert the microSD card into the Arietta slot and power it.
The image just built is fairly basic and the only output
you will get is on serial console, please consider to use a DPI
cable (http://www.acmesystems.it/DPI)

View File

@@ -0,0 +1,247 @@
/*
* Device Tree Generator version: 1.3
*
* (C) Copyright 2007-2008 Xilinx, Inc.
* (C) Copyright 2007-2009 Michal Simek
*
* Michal SIMEK <monstr@monstr.eu>
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License as
* published by the Free Software Foundation; either version 2 of
* the License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place, Suite 330, Boston,
* MA 02111-1307 USA
*
* CAUTION: This file is automatically generated by libgen.
* Version: Xilinx EDK 13.2 EDK_O.61xd
*
* XPS project directory: device-tree_bsp_230-orig
*/
/dts-v1/;
/ {
#address-cells = <1>;
#size-cells = <1>;
compatible = "xlnx,microblaze";
model = "testing";
MCB3_LPDDR: memory@80000000 {
device_type = "memory";
reg = < 0x80000000 0x4000000 >;
} ;
aliases {
ethernet0 = &Ethernet_MAC;
serial0 = &USB_Uart;
} ;
chosen {
bootargs = "console=ttyUL0";
linux,stdout-path = "/axi@0/serial@40600000";
} ;
cpus {
#address-cells = <1>;
#cpus = <0x1>;
#size-cells = <0>;
microblaze_0: cpu@0 {
clock-frequency = <66666667>;
compatible = "xlnx,microblaze-8.20.a";
d-cache-baseaddr = <0x80000000>;
d-cache-highaddr = <0x83ffffff>;
d-cache-line-size = <0x10>;
d-cache-size = <0x2000>;
device_type = "cpu";
i-cache-baseaddr = <0x80000000>;
i-cache-highaddr = <0x83ffffff>;
i-cache-line-size = <0x10>;
i-cache-size = <0x2000>;
model = "microblaze,8.20.a";
reg = <0>;
timebase-frequency = <66666667>;
xlnx,addr-tag-bits = <0xd>;
xlnx,allow-dcache-wr = <0x1>;
xlnx,allow-icache-wr = <0x1>;
xlnx,area-optimized = <0x0>;
xlnx,avoid-primitives = <0x0>;
xlnx,branch-target-cache-size = <0x0>;
xlnx,cache-byte-size = <0x2000>;
xlnx,d-axi = <0x1>;
xlnx,d-lmb = <0x1>;
xlnx,d-plb = <0x0>;
xlnx,data-size = <0x20>;
xlnx,dcache-addr-tag = <0xd>;
xlnx,dcache-always-used = <0x1>;
xlnx,dcache-byte-size = <0x2000>;
xlnx,dcache-data-width = <0x0>;
xlnx,dcache-force-tag-lutram = <0x0>;
xlnx,dcache-interface = <0x0>;
xlnx,dcache-line-len = <0x4>;
xlnx,dcache-use-fsl = <0x0>;
xlnx,dcache-use-writeback = <0x0>;
xlnx,dcache-victims = <0x0>;
xlnx,debug-enabled = <0x1>;
xlnx,div-zero-exception = <0x0>;
xlnx,dynamic-bus-sizing = <0x1>;
xlnx,ecc-use-ce-exception = <0x0>;
xlnx,edge-is-positive = <0x1>;
xlnx,endianness = <0x1>;
xlnx,family = "spartan6";
xlnx,fault-tolerant = <0x0>;
xlnx,fpu-exception = <0x0>;
xlnx,freq = <0x3f940ab>;
xlnx,fsl-data-size = <0x20>;
xlnx,fsl-exception = <0x0>;
xlnx,fsl-links = <0x0>;
xlnx,i-axi = <0x0>;
xlnx,i-lmb = <0x1>;
xlnx,i-plb = <0x0>;
xlnx,icache-always-used = <0x1>;
xlnx,icache-data-width = <0x0>;
xlnx,icache-force-tag-lutram = <0x0>;
xlnx,icache-interface = <0x0>;
xlnx,icache-line-len = <0x4>;
xlnx,icache-streams = <0x0>;
xlnx,icache-use-fsl = <0x0>;
xlnx,icache-victims = <0x0>;
xlnx,ill-opcode-exception = <0x0>;
xlnx,instance = "microblaze_0";
xlnx,interconnect = <0x2>;
xlnx,interconnect-m-axi-dc-aw-register = <0x0>;
xlnx,interconnect-m-axi-dc-read-issuing = <0x2>;
xlnx,interconnect-m-axi-dc-w-register = <0x0>;
xlnx,interconnect-m-axi-dc-write-issuing = <0x20>;
xlnx,interconnect-m-axi-dp-read-issuing = <0x1>;
xlnx,interconnect-m-axi-dp-write-issuing = <0x1>;
xlnx,interconnect-m-axi-ic-read-issuing = <0x2>;
xlnx,interconnect-m-axi-ip-read-issuing = <0x1>;
xlnx,interrupt-is-edge = <0x0>;
xlnx,lockstep-slave = <0x0>;
xlnx,mmu-dtlb-size = <0x1>;
xlnx,mmu-itlb-size = <0x1>;
xlnx,mmu-privileged-instr = <0x0>;
xlnx,mmu-tlb-access = <0x3>;
xlnx,mmu-zones = <0x2>;
xlnx,number-of-pc-brk = <0x1>;
xlnx,number-of-rd-addr-brk = <0x0>;
xlnx,number-of-wr-addr-brk = <0x0>;
xlnx,opcode-0x0-illegal = <0x0>;
xlnx,optimization = <0x0>;
xlnx,pvr = <0x0>;
xlnx,pvr-user1 = <0x0>;
xlnx,pvr-user2 = <0x0>;
xlnx,reset-msr = <0x0>;
xlnx,sco = <0x0>;
xlnx,stream-interconnect = <0x0>;
xlnx,unaligned-exceptions = <0x0>;
xlnx,use-barrel = <0x1>;
xlnx,use-branch-target-cache = <0x0>;
xlnx,use-dcache = <0x1>;
xlnx,use-div = <0x0>;
xlnx,use-ext-brk = <0x1>;
xlnx,use-ext-nm-brk = <0x1>;
xlnx,use-extended-fsl-instr = <0x0>;
xlnx,use-fpu = <0x0>;
xlnx,use-hw-mul = <0x1>;
xlnx,use-icache = <0x1>;
xlnx,use-interrupt = <0x1>;
xlnx,use-mmu = <0x3>;
xlnx,use-msr-instr = <0x1>;
xlnx,use-pcmp-instr = <0x0>;
xlnx,use-stack-protection = <0x0>;
} ;
} ;
axi4lite_0: axi@0 {
#address-cells = <1>;
#size-cells = <1>;
compatible = "xlnx,axi-interconnect-1.03.a", "simple-bus";
ranges ;
Ethernet_MAC: ethernet@40e00000 {
compatible = "xlnx,axi-ethernetlite-1.00.a", "xlnx,xps-ethernetlite-1.00.a";
device_type = "network";
interrupt-parent = <&microblaze_0_intc>;
interrupts = < 2 0 >;
local-mac-address = [ 00 0a 35 aa de 00 ];
// phy-handle = <&phy0>;
reg = < 0x40e00000 0x10000 >;
xlnx,duplex = <0x1>;
xlnx,family = "spartan6";
xlnx,include-global-buffers = <0x0>;
xlnx,include-internal-loopback = <0x0>;
xlnx,include-mdio = <0x1>;
xlnx,include-phy-constraints = <0x1>;
xlnx,interconnect-s-axi-read-acceptance = <0x1>;
xlnx,interconnect-s-axi-write-acceptance = <0x1>;
xlnx,rx-ping-pong = <0x0>;
xlnx,s-axi-aclk-period-ps = <0x3a98>;
xlnx,s-axi-id-width = <0x1>;
xlnx,s-axi-supports-narrow-burst = <0x0>;
xlnx,tx-ping-pong = <0x0>;
/*
mdio {
#address-cells = <1>;
#size-cells = <0>;
phy0: phy@7 {
compatible = "marvell,88e1111";
device_type = "ethernet-phy";
reg = <7>;
} ;
} ;
*/
} ;
SPI_FLASH: spi@40a00000 {
compatible = "xlnx,axi-spi-1.01.a", "xlnx,xps-spi-2.00.a";
interrupt-parent = <&microblaze_0_intc>;
interrupts = < 1 2 >;
reg = < 0x40a00000 0x10000 >;
xlnx,family = "spartan6";
xlnx,fifo-exist = <0x1>;
xlnx,num-ss-bits = <0x1>;
xlnx,num-transfer-bits = <0x8>;
xlnx,sck-ratio = <0x4>;
} ;
USB_Uart: serial@40600000 {
clock-frequency = <66666667>;
compatible = "xlnx,axi-uartlite-1.02.a", "xlnx,xps-uartlite-1.00.a";
current-speed = <115200>;
device_type = "serial";
interrupt-parent = <&microblaze_0_intc>;
interrupts = < 3 0 >;
port-number = <0>;
reg = < 0x40600000 0x10000 >;
xlnx,baudrate = <0x1c200>;
xlnx,data-bits = <0x8>;
xlnx,family = "spartan6";
xlnx,odd-parity = <0x1>;
xlnx,s-axi-aclk-freq-hz = <0x3f940ab>;
xlnx,use-parity = <0x0>;
} ;
microblaze_0_intc: interrupt-controller@41200000 {
#interrupt-cells = <0x2>;
compatible = "xlnx,axi-intc-1.01.a", "xlnx,xps-intc-1.00.a";
interrupt-controller ;
reg = < 0x41200000 0x10000 >;
xlnx,kind-of-intr = <0xc>;
xlnx,num-intr-inputs = <0x4>;
} ;
system_timer: timer@41c00000 {
clock-frequency = <66666667>;
compatible = "xlnx,axi-timer-1.02.a", "xlnx,xps-timer-1.00.a";
interrupt-parent = <&microblaze_0_intc>;
interrupts = < 0 2 >;
reg = < 0x41c00000 0x10000 >;
xlnx,count-width = <0x20>;
xlnx,family = "spartan6";
xlnx,gen0-assert = <0x1>;
xlnx,gen1-assert = <0x1>;
xlnx,one-timer-only = <0x0>;
xlnx,trig0-assert = <0x1>;
xlnx,trig1-assert = <0x1>;
} ;
} ;
} ;

View File

@@ -0,0 +1,68 @@
CONFIG_EXPERIMENTAL=y
CONFIG_SYSVIPC=y
CONFIG_IKCONFIG=y
CONFIG_IKCONFIG_PROC=y
CONFIG_BLK_DEV_INITRD=y
CONFIG_INITRAMFS_SOURCE="rootfs.cpio"
CONFIG_INITRAMFS_COMPRESSION_GZIP=y
# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
CONFIG_EXPERT=y
CONFIG_KALLSYMS_ALL=y
CONFIG_KALLSYMS_EXTRA_PASS=y
# CONFIG_HOTPLUG is not set
# CONFIG_BASE_FULL is not set
# CONFIG_FUTEX is not set
# CONFIG_EPOLL is not set
# CONFIG_SIGNALFD is not set
# CONFIG_SHMEM is not set
CONFIG_SLAB=y
CONFIG_MODULES=y
CONFIG_MODULE_UNLOAD=y
# CONFIG_BLK_DEV_BSG is not set
# CONFIG_OPT_LIB_ASM is not set
CONFIG_KERNEL_BASE_ADDR=0x80000000
CONFIG_XILINX_MICROBLAZE0_FAMILY="spartan6"
CONFIG_XILINX_MICROBLAZE0_USE_MSR_INSTR=1
# CONFIG_XILINX_MICROBLAZE0_USE_PCMP_INSTR is not set
CONFIG_XILINX_MICROBLAZE0_USE_BARREL=1
CONFIG_XILINX_MICROBLAZE0_USE_HW_MUL=1
CONFIG_XILINX_MICROBLAZE0_HW_VER="8.20.a"
CONFIG_HZ_100=y
CONFIG_MMU=y
CONFIG_CMDLINE_BOOL=y
CONFIG_CMDLINE_FORCE=y
CONFIG_NET=y
CONFIG_PACKET=y
CONFIG_UNIX=y
CONFIG_INET=y
# CONFIG_INET_LRO is not set
# CONFIG_IPV6 is not set
CONFIG_PROC_DEVICETREE=y
CONFIG_BLK_DEV_RAM=y
CONFIG_BLK_DEV_RAM_SIZE=8192
CONFIG_NETDEVICES=y
CONFIG_NET_ETHERNET=y
CONFIG_XILINX_EMACLITE=y
# CONFIG_INPUT is not set
# CONFIG_SERIO is not set
# CONFIG_VT is not set
CONFIG_SERIAL_UARTLITE=y
CONFIG_SERIAL_UARTLITE_CONSOLE=y
# CONFIG_HW_RANDOM is not set
# CONFIG_HWMON is not set
# CONFIG_USB_SUPPORT is not set
CONFIG_EXT2_FS=y
# CONFIG_DNOTIFY is not set
CONFIG_NFS_FS=y
CONFIG_NFS_V3=y
CONFIG_CIFS=y
CONFIG_CIFS_STATS=y
CONFIG_CIFS_STATS2=y
CONFIG_PARTITION_ADVANCED=y
CONFIG_DEBUG_KERNEL=y
CONFIG_DETECT_HUNG_TASK=y
CONFIG_DEBUG_SLAB=y
CONFIG_DEBUG_SPINLOCK=y
CONFIG_DEBUG_INFO=y
CONFIG_EARLY_PRINTK=y
# CONFIG_CRYPTO_ANSI_CPRNG is not set

View File

@@ -0,0 +1,70 @@
This is the buildroot board support for the Avnet Spartan6 LX9 MicroBoard.
The Avnet S6LX9 Microboard is a small USB-Stick sized module containing
a Spartan6 FPGA capable of running the Microblaze softcore processor
together with RAM and FLASH memory.
The board can be bought from Avnet (avnet.com) or from Trenz Electronic
(www.trenz-electronic.de) for a low price.
To run the Linux built with buildroot you have to install the FPGA bitfile
and u-boot as described in the tutorial AvtS6LX9MicroBoard_SW302_PetaLinux
available on http://www.em.avnet.com/s6microboard
On this site also is a forum containing information on how to build your own
Microblaze processor for the Microboard.
The image file (default name is simpleImage.lx9_mmu.ub) has to be copied
to your tftp folder (often /tftpboot/) or can be programmed into the
board's SPI flash.
Sample session:
$ make s6lx9_microboard_defconfig
$ make
$ cp build/linux-<version>/arch/microblaze/boot/simpleImage.lx9_mmu.ub /tftpboot/br12.2a.ub
$ minicom
<hit the reset button on the S6LX9 Microboard>
Icache:ON
Dcache:ON
U-Boot Start:0x83f00000
SF: Got idcode 20 ba 18 10 01
*** Warning - bad CRC, using default environment
Net: Xilinx_Emaclite
MAC: 00:0a:35:00:63:37
U-BOOT for Avnet-LX9-Microboard-AXI-tiny-13.1
BOOTP broadcast 1
DHCP client bound to address 192.168.11.122
Hit any key to stop autoboot: 0
U-Boot-PetaLinux> tftp br12.2a.ub
Using Xilinx_Emaclite device
TFTP from server 192.168.11.10; our IP address is 192.168.11.122
Filename 'br12.2a.ub'.
Load address: 0x80002000
Loading: #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
##############################
done
Bytes transferred = 5207724 (4f76ac hex)
U-Boot-PetaLinux> bootm
## Booting kernel from Legacy Image at 80002000 ...
Image Name: Linux-3.1.0
Image Type: MicroBlaze Linux Kernel Image (uncompressed)
Data Size: 5207660 Bytes = 5 MB
Load Address: 80000000
Entry Point: 80000000
Verifying Checksum ... OK
Loading Kernel Image ... OK
OK
## Transferring control to Linux (at address 80000000), 0x80000000 ramdisk 0x00000000, FDT 0x00000000...
Early console on uartlite at 0x40600000
..... boot log skipped
Welcome to Microblaze Buildroot
Microblaze login:

View File

@@ -1,2 +1,2 @@
# From https://cdn.kernel.org/pub/linux/kernel/v6.x/sha256sums.asc
sha256 ac26e508abd56e9f8b89872b6e10c49fc823bcc70d8068a5d8504c1a7c4ff045 linux-6.18.38.tar.xz
sha256 d0a78bf3f0d12aaa10af3b5adcaed5bc767b5b78705e5ef885d5e930b72e25d5 linux-6.18.1.tar.xz

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 78e8bfc382fe388f9b55aa1daf8c563522a037779b5d4c349d1415e381f1243e u-boot-2026.07.tar.bz2
sha256 b60d5865cefdbc75da8da4156c56c458e00de75a49b80c1a2e58a96e30ad0d54 u-boot-2026.01.tar.bz2

View File

@@ -0,0 +1,2 @@
# Locally calculated
sha256 7efa89e1b4e4106ee05d68e876c8efbb146364d89cfd5d26bf4647b09c08f32b arm-trusted-firmware-v2.10-git4.tar.gz

View File

@@ -0,0 +1 @@
../linux/linux.hash

View File

@@ -1,2 +1,2 @@
# From https://www.kernel.org/pub/linux/kernel/v6.x/sha256sums.asc
sha256 4f21c01f4d04c1d1b3ed794153f8900802c92497be620b07c4869530f2d28ee3 linux-6.18.16.tar.xz
sha256 9b4ccec7d8ceff4824f149e476ec06e83c86546ae8af82582871647809a62ef0 linux-6.12.70.tar.xz

View File

@@ -0,0 +1,2 @@
# Locally calculated
sha256 c0f23ccc71c49989e9ad238acf334473c17b7c88f79a20c829c3d443e3794a22 arm-trusted-firmware-v2.11-git4.tar.gz

View File

@@ -0,0 +1 @@
../linux/linux.hash

View File

@@ -1,2 +1,2 @@
# From https://www.kernel.org/pub/linux/kernel/v6.x/sha256sums.asc
sha256 4f21c01f4d04c1d1b3ed794153f8900802c92497be620b07c4869530f2d28ee3 linux-6.18.16.tar.xz
# Locally calculated
sha256 774698422ee54c5f1e704456f37c65c06b51b4e9a8b0866f34580d86fef8e226 linux-6.10.tar.xz

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 b60d5865cefdbc75da8da4156c56c458e00de75a49b80c1a2e58a96e30ad0d54 u-boot-2026.01.tar.bz2
sha256 f591da9ab90ef3d6b3d173766d0ddff90c4ed7330680897486117df390d83c8f u-boot-2024.07.tar.bz2

View File

@@ -0,0 +1 @@
../linux/linux.hash

View File

@@ -1,2 +1,2 @@
# From https://www.kernel.org/pub/linux/kernel/v6.x/sha256sums.asc
sha256 4f21c01f4d04c1d1b3ed794153f8900802c92497be620b07c4869530f2d28ee3 linux-6.18.16.tar.xz
# Locally calculated
sha256 2bb586c954277d070c8fdf6d7275faa93b4807d9bf3353b491d8149cca02b4fc linux-6.15.6.tar.xz

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 b60d5865cefdbc75da8da4156c56c458e00de75a49b80c1a2e58a96e30ad0d54 u-boot-2026.01.tar.bz2
sha256 0f933f6c5a426895bf306e93e6ac53c60870e4b54cda56d95211bec99e63bec7 u-boot-2025.07.tar.bz2

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 b60d5865cefdbc75da8da4156c56c458e00de75a49b80c1a2e58a96e30ad0d54 u-boot-2026.01.tar.bz2
sha256 0f933f6c5a426895bf306e93e6ac53c60870e4b54cda56d95211bec99e63bec7 u-boot-2025.07.tar.bz2

View File

@@ -1,2 +1,2 @@
# From https://cdn.kernel.org/pub/linux/kernel/v6.x/sha256sums.asc
sha256 7d2e1b5d5ab36b3a01856e71782dad2a54e634fb2b37c0a42998def3bbf957c1 linux-6.12.96.tar.xz
sha256 d1ad94a33681148efe884f4028970d69e332f2b003f0e8be53a1d25de38e49a2 linux-6.12.64.tar.xz

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 78e8bfc382fe388f9b55aa1daf8c563522a037779b5d4c349d1415e381f1243e u-boot-2026.07.tar.bz2
sha256 b60d5865cefdbc75da8da4156c56c458e00de75a49b80c1a2e58a96e30ad0d54 u-boot-2026.01.tar.bz2

View File

@@ -1,2 +1,2 @@
# From https://www.kernel.org/pub/linux/kernel/v6.x/sha256sums.asc
sha256 7d2e1b5d5ab36b3a01856e71782dad2a54e634fb2b37c0a42998def3bbf957c1 linux-6.12.96.tar.xz
sha256 d1ad94a33681148efe884f4028970d69e332f2b003f0e8be53a1d25de38e49a2 linux-6.12.64.tar.xz

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 78e8bfc382fe388f9b55aa1daf8c563522a037779b5d4c349d1415e381f1243e u-boot-2026.07.tar.bz2
sha256 b60d5865cefdbc75da8da4156c56c458e00de75a49b80c1a2e58a96e30ad0d54 u-boot-2026.01.tar.bz2

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 b60d5865cefdbc75da8da4156c56c458e00de75a49b80c1a2e58a96e30ad0d54 u-boot-2026.01.tar.bz2
sha256 0f933f6c5a426895bf306e93e6ac53c60870e4b54cda56d95211bec99e63bec7 u-boot-2025.07.tar.bz2

View File

@@ -0,0 +1 @@
../linux/linux.hash

View File

@@ -1,2 +1,2 @@
# From https://www.kernel.org/pub/linux/kernel/v7.x/sha256sums.asc
sha256 be41c068e88f5242a19bccdbffbe077b18c47b45f627e2325504b4fab79dd1dc linux-7.1.3.tar.xz
# Locally calculated
sha256 b4850cf670a032c70f38b713a27d62046c5f747caf028c5f50b18f98606a9eb1 linux-6.12.52.tar.xz

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 78e8bfc382fe388f9b55aa1daf8c563522a037779b5d4c349d1415e381f1243e u-boot-2026.07.tar.bz2
sha256 b4f032848e56cc8f213ad59f9132c084dbbb632bc29176d024e58220e0efdf4a u-boot-2025.10.tar.bz2

View File

@@ -0,0 +1 @@
../linux/linux.hash

View File

@@ -1,2 +1,2 @@
# From https://www.kernel.org/pub/linux/kernel/v7.x/sha256sums.asc
sha256 be41c068e88f5242a19bccdbffbe077b18c47b45f627e2325504b4fab79dd1dc linux-7.1.3.tar.xz
# Locally calculated
sha256 b4850cf670a032c70f38b713a27d62046c5f747caf028c5f50b18f98606a9eb1 linux-6.12.52.tar.xz

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 78e8bfc382fe388f9b55aa1daf8c563522a037779b5d4c349d1415e381f1243e u-boot-2026.07.tar.bz2
sha256 b4f032848e56cc8f213ad59f9132c084dbbb632bc29176d024e58220e0efdf4a u-boot-2025.10.tar.bz2

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 6fd749e53c455aec3418288630544e7552bbffab4442ddc48b20ebef9aee87ff arm-trusted-firmware-v2.14-git4.tar.gz
sha256 c0f23ccc71c49989e9ad238acf334473c17b7c88f79a20c829c3d443e3794a22 arm-trusted-firmware-v2.11-git4.tar.gz

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 f4855f382c1b735c84072bdef36db5bcd5dc7b0c37e42f5104317149a0a486ef linux-6.18.18.tar.xz
sha256 f74812f78e88992c416434cb107639e13a551dbaff36bb90d6346ab16ab71a95 linux-6.6.56.tar.xz

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 b60d5865cefdbc75da8da4156c56c458e00de75a49b80c1a2e58a96e30ad0d54 u-boot-2026.01.tar.bz2
sha256 f591da9ab90ef3d6b3d173766d0ddff90c4ed7330680897486117df390d83c8f u-boot-2024.07.tar.bz2

View File

@@ -1 +0,0 @@
CONFIG_IMX_SDMA=m

View File

@@ -1,2 +0,0 @@
# Locally calculated
sha256 37f0c5d5c242c1d604e87d48f08795e861a5a85f725b4ca11d0a538f12ff8cff linux-6.18.8.tar.xz

View File

@@ -1,2 +0,0 @@
# Locally calculated
sha256 b60d5865cefdbc75da8da4156c56c458e00de75a49b80c1a2e58a96e30ad0d54 u-boot-2026.01.tar.bz2

View File

@@ -1,64 +0,0 @@
****************************
Freescale i.MX6ULL EVK board
****************************
This file documents the Buildroot support for the Freescale i.MX6ULL EVK board
using Upstream U-Boot and Linux.
Build
=====
First, configure Buildroot for your i.MX6ULL EVK board:
In order to do so issue:
make imx6ullevk_defconfig
Build all components:
make
You will find in output/images/ the following files:
- boot.vfat
- imx6ull-14x14-evk.dtb
- rootfs.ext2
- rootfs.ext4
- rootfs.tar
- sdcard.img
- u-boot.bin
- u-boot-dtb.imx
- zImage
Create a bootable SD card
=========================
To determine the device associated to the SD card have a look in the
/proc/partitions file:
cat /proc/partitions
Buildroot prepares a bootable "sdcard.img" image in the output/images/
directory, ready to be dumped on a SD card. Launch the following
command as root:
dd if=./output/images/sdcard.img of=/dev/<your-sd-device>
*** WARNING! This will destroy all the card content. Use with care! ***
For details about the medium image layout, see the definition in
board/freescale/common/imx/genimage.cfg.template.
Boot the i.MX6ULL EVK board
===========================
To boot your newly created system (refer to the i.MX 6ULL EVK Quick Start Guide [1] for guidance):
- insert the SD card in the micro SD slot of the board;
- put a micro USB cable into the Debug USB Port and connect using a terminal
emulator at 115200 bps, 8n1;
- power on the board.
Enjoy!
References
==========
[1] https://www.nxp.com/webapp/Download?colCode=IMX6ULLQSG

View File

@@ -2,18 +2,25 @@
Freescale i.MX6ULL EVK board
****************************
This file documents the Buildroot support for the Freescale i.MX6ULL EVK board
using Vendor U-Boot and Linux.
This file documents the Buildroot support for the Freescale i.MX6ULL EVK board.
Build
=====
First, configure Buildroot for your i.MX6ULL EVK board:
In order to do so issue:
In order to do so there are two supported options:
make freescale_imx6ullevk_defconfig
if you plan to use NXP provided U-Boot and kernel.
or
make imx6ullevk_defconfig
if you plan to use mainline U-Boot and mainline kernel.
Build all components:
make

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 d7813f4ad5431edb162d6be2775bc021f9007b9c6934e977330291168523a507 imx-atf-lf-6.18.20-2.0.0.tar.gz
sha256 8cfe0afc903ebbc03f27e4874aa9ce82be78843a8b42ed4c906871e7f311b510 imx-atf-lf-6.6.36-2.1.0.tar.gz

View File

@@ -0,0 +1 @@
../linux/linux.hash

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 a8f55764fd1418db8adfd2711c0abb7d5464a8ee1cbfd0f6878f1059ecfa1316 linux-imx-lf-6.18.20-2.0.0.tar.gz
sha256 3f5017e85ba6c490be597670033a7eaba14e3c34af4e53d24dc3762c3deece83 linux-imx-lf-6.6.36-2.1.0-imx91frdm.tar.gz

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 96942f8c49736b7d40277891bf0a34cfdd0afb59390f79b65b2b33b3bbd19f61 uboot-imx-lf-6.18.20-2.0.0.tar.gz
sha256 f7d9a6e99825926d0bc597e0fdfeafffcc76ad6267f1d4e9aae1fe9a8d400c22 uboot-imx-lf-6.6.36-2.1.0-imx91frdm.tar.gz

View File

@@ -1 +0,0 @@
# CONFIG_EFI_CAPSULE_AUTHENTICATE is not set

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 d7813f4ad5431edb162d6be2775bc021f9007b9c6934e977330291168523a507 imx-atf-lf-6.18.20-2.0.0.tar.gz
sha256 8cfe0afc903ebbc03f27e4874aa9ce82be78843a8b42ed4c906871e7f311b510 imx-atf-lf-6.6.36-2.1.0.tar.gz

View File

@@ -0,0 +1 @@
../linux/linux.hash

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 a8f55764fd1418db8adfd2711c0abb7d5464a8ee1cbfd0f6878f1059ecfa1316 linux-imx-lf-6.18.20-2.0.0.tar.gz
sha256 3244dc3c62c990d9de90e1c7193aa3099e0e74e720de5c9c13edfbfdd802f596 linux-imx-lf-6.6.36-2.1.0-imx93frdm.tar.gz

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 96942f8c49736b7d40277891bf0a34cfdd0afb59390f79b65b2b33b3bbd19f61 uboot-imx-lf-6.18.20-2.0.0.tar.gz
sha256 bced4334363199d5465532d221d06dc3a5b49271067d74408019c825ed2ca715 uboot-imx-lf-6.6.36-2.1.0-imx93frdm.tar.gz

View File

@@ -1 +0,0 @@
# CONFIG_EFI_CAPSULE_AUTHENTICATE is not set

View File

@@ -1,2 +1,2 @@
# From https://www.kernel.org/pub/linux/kernel/v6.x/sha256sums.asc
sha256 f4855f382c1b735c84072bdef36db5bcd5dc7b0c37e42f5104317149a0a486ef linux-6.18.18.tar.xz
sha256 0fcbbbbcd456e87bbbfc8bf37af541fda62ccfcce76903503424fd101ef7bdee linux-6.12.43.tar.xz

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 b60d5865cefdbc75da8da4156c56c458e00de75a49b80c1a2e58a96e30ad0d54 u-boot-2026.01.tar.bz2
sha256 0f933f6c5a426895bf306e93e6ac53c60870e4b54cda56d95211bec99e63bec7 u-boot-2025.07.tar.bz2

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 658af40a90fd8e2460d364775a0c37e0507201e49de7f69c8a22d61e179f81e1 atf-lf-6.18.20-2.0.0.tar.gz
sha256 2d3f9c52e16766c290bdc0bc130d634e4c326a5b236dfb2f2ca3f0fa457e82d4 atf-lf-6.12.34-2.1.0.tar.gz

View File

@@ -1,2 +1,2 @@
# Locally computed
sha256 206f997d41bb958099bf7a89a02a6889942b118984f81f9a45bec9907f60708f linux-lf-6.18.20-2.0.0.tar.gz
sha256 27a1987ca0a5802d3ebb296b8134ec66d813ad86cf2a60779b45092735bbb23b linux-lf-6.12.34-2.1.0.tar.gz

View File

@@ -1,2 +1,2 @@
# Locally computed
sha256 04aed627132db7b656117c7a35fb29d314172319fa3a297ea6748eebac2b5ce3 u-boot-lf-6.18.20-2.0.0.tar.gz
sha256 2f25cde388b2f83ff7a8e3afe25aafb1db48dafb0fa3bf1e4f9fef603f3b4785 u-boot-lf-6.12.34-2.1.0.tar.gz

View File

@@ -11,7 +11,7 @@ For more details about the board and the QorIQ Layerscape SoC, see the following
Layerscape platforms are officially supported by NXP under the Layerscape
Debian Linux SDK (LDLSDK). This uses components from Linux Factory (project
common with i.MX), but has a slower release cadence than LF. The currently used
tag is lf-6.18.20-2.0.0, which is in line with the latest LF tag. Generally, in
tag is lf-6.12.34-2.1.0, which is in line with the latest LF tag. Generally, in
Buildroot, the latest Linux Factory release tag is always used, which may be
considered pre-release software, as it may contain features which are not yet
documented, and it generally undergoes less testing.
@@ -21,11 +21,11 @@ For the software Layerscape Debian Linux SDK User Guide, see:
- https://www.nxp.com/docs/en/user-guide/UG10143.pdf
The components from NXP are:
- rcw, lf-6.18.20-2.0.0
- atf (fork), lf-6.18.20-2.0.0
- uboot (fork), lf-6.18.20-2.0.0
- rcw, lf-6.12.34-2.1.0
- atf (fork), lf-6.12.34-2.1.0
- uboot (fork), lf-6.12.34-2.1.0
- cadence-dp-firmware (blob), 8.16
- linux (fork), lf-6.18.20-2.0.0
- linux (fork), lf-6.12.34-2.1.0
Build
=====

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 658af40a90fd8e2460d364775a0c37e0507201e49de7f69c8a22d61e179f81e1 atf-lf-6.18.20-2.0.0.tar.gz
sha256 2d3f9c52e16766c290bdc0bc130d634e4c326a5b236dfb2f2ca3f0fa457e82d4 atf-lf-6.12.34-2.1.0.tar.gz

View File

@@ -1,2 +1,2 @@
# Locally computed
sha256 206f997d41bb958099bf7a89a02a6889942b118984f81f9a45bec9907f60708f linux-lf-6.18.20-2.0.0.tar.gz
sha256 27a1987ca0a5802d3ebb296b8134ec66d813ad86cf2a60779b45092735bbb23b linux-lf-6.12.34-2.1.0.tar.gz

View File

@@ -1,2 +1,2 @@
# Locally computed
sha256 04aed627132db7b656117c7a35fb29d314172319fa3a297ea6748eebac2b5ce3 u-boot-lf-6.18.20-2.0.0.tar.gz
sha256 2f25cde388b2f83ff7a8e3afe25aafb1db48dafb0fa3bf1e4f9fef603f3b4785 u-boot-lf-6.12.34-2.1.0.tar.gz

View File

@@ -11,7 +11,7 @@ for more details about the board and the QorIQ Layerscape SoC, see the following
Layerscape platforms are officially supported by NXP under the Layerscape
Debian Linux SDK (LDLSDK). This uses components from Linux Factory (project
common with i.MX), but has a slower release cadence than LF. The currently used
tag is lf-6.18.20-2.0.0, which is in line with the latest LF tag. Generally, in
tag is lf-6.12.34-2.1.0, which is in line with the latest LF tag. Generally, in
Buildroot, the latest Linux Factory release tag is always used, which may be
considered pre-release software, as it may contain features which are not yet
documented, and it generally undergoes less testing.
@@ -21,13 +21,13 @@ For the software Layerscape Debian Linux SDK User Guide, see:
- https://www.nxp.com/docs/en/user-guide/UG10143.pdf
The components from NXP are:
- rcw, lf-6.18.20-2.0.0
- atf (fork), lf-6.18.20-2.0.0
- uboot (fork), lf-6.18.20-2.0.0
- qoriq-fm-ucode (blob), lf-6.18.20-2.0.0
- linux (fork), lf-6.18.20-2.0.0
- fmlib, lf-6.18.20-2.0.0
- fmc, lf-6.18.20-2.0.0
- rcw, lf-6.12.34-2.1.0
- atf (fork), lf-6.12.34-2.1.0
- uboot (fork), lf-6.12.34-2.1.0
- qoriq-fm-ucode (blob), lf-6.12.34-2.1.0
- linux (fork), lf-6.12.34-2.1.0
- fmlib, lf-6.12.34-2.1.0
- fmc, lf-6.12.34-2.1.0
Build
=====

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 658af40a90fd8e2460d364775a0c37e0507201e49de7f69c8a22d61e179f81e1 atf-lf-6.18.20-2.0.0.tar.gz
sha256 2d3f9c52e16766c290bdc0bc130d634e4c326a5b236dfb2f2ca3f0fa457e82d4 atf-lf-6.12.34-2.1.0.tar.gz

View File

@@ -1,2 +1,2 @@
# Locally computed
sha256 206f997d41bb958099bf7a89a02a6889942b118984f81f9a45bec9907f60708f linux-lf-6.18.20-2.0.0.tar.gz
sha256 27a1987ca0a5802d3ebb296b8134ec66d813ad86cf2a60779b45092735bbb23b linux-lf-6.12.34-2.1.0.tar.gz

View File

@@ -1,2 +1,2 @@
# Locally computed
sha256 04aed627132db7b656117c7a35fb29d314172319fa3a297ea6748eebac2b5ce3 u-boot-lf-6.18.20-2.0.0.tar.gz
sha256 2f25cde388b2f83ff7a8e3afe25aafb1db48dafb0fa3bf1e4f9fef603f3b4785 u-boot-lf-6.12.34-2.1.0.tar.gz

View File

@@ -12,7 +12,7 @@ For more details about the board and the QorIQ Layerscape SoC, see the following
Layerscape platforms are officially supported by NXP under the Layerscape
Debian Linux SDK (LDLSDK). This uses components from Linux Factory (project
common with i.MX), but has a slower release cadence than LF. The currently used
tag is lf-6.18.20-2.0.0, which is in line with the latest LF tag. Generally, in
tag is lf-6.12.34-2.1.0, which is in line with the latest LF tag. Generally, in
Buildroot, the latest Linux Factory release tag is always used, which may be
considered pre-release software, as it may contain features which are not yet
documented, and it generally undergoes less testing.
@@ -22,13 +22,13 @@ For the software Layerscape Debian Linux SDK User Guide, see:
- https://www.nxp.com/docs/en/user-guide/UG10143.pdf
The components from NXP are:
- rcw, lf-6.18.20-2.0.0
- atf (fork), lf-6.18.20-2.0.0
- uboot (fork), lf-6.18.20-2.0.0
- qoriq-fm-ucode (blob), lf-6.18.20-2.0.0
- linux (fork), lf-6.18.20-2.0.0
- fmlib, lf-6.18.20-2.0.0
- fmc, lf-6.18.20-2.0.0
- rcw, lf-6.12.34-2.1.0
- atf (fork), lf-6.12.34-2.1.0
- uboot (fork), lf-6.12.34-2.1.0
- qoriq-fm-ucode (blob), lf-6.12.34-2.1.0
- linux (fork), lf-6.12.34-2.1.0
- fmlib, lf-6.12.34-2.1.0
- fmc, lf-6.12.34-2.1.0
Build
=====

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 658af40a90fd8e2460d364775a0c37e0507201e49de7f69c8a22d61e179f81e1 atf-lf-6.18.20-2.0.0.tar.gz
sha256 2d3f9c52e16766c290bdc0bc130d634e4c326a5b236dfb2f2ca3f0fa457e82d4 atf-lf-6.12.34-2.1.0.tar.gz

View File

@@ -1,2 +1,2 @@
# Locally computed
sha256 206f997d41bb958099bf7a89a02a6889942b118984f81f9a45bec9907f60708f linux-lf-6.18.20-2.0.0.tar.gz
sha256 27a1987ca0a5802d3ebb296b8134ec66d813ad86cf2a60779b45092735bbb23b linux-lf-6.12.34-2.1.0.tar.gz

View File

@@ -1,2 +1,2 @@
# Locally computed
sha256 04aed627132db7b656117c7a35fb29d314172319fa3a297ea6748eebac2b5ce3 u-boot-lf-6.18.20-2.0.0.tar.gz
sha256 2f25cde388b2f83ff7a8e3afe25aafb1db48dafb0fa3bf1e4f9fef603f3b4785 u-boot-lf-6.12.34-2.1.0.tar.gz

View File

@@ -11,7 +11,7 @@ for more details about the board and the QorIQ Layerscape SoC, see the following
Layerscape platforms are officially supported by NXP under the Layerscape
Debian Linux SDK (LDLSDK). This uses components from Linux Factory (project
common with i.MX), but has a slower release cadence than LF. The currently used
tag is lf-6.18.20-2.0.0, which is in line with the latest LF tag. Generally, in
tag is lf-6.12.34-2.1.0, which is in line with the latest LF tag. Generally, in
Buildroot, the latest Linux Factory release tag is always used, which may be
considered pre-release software, as it may contain features which are not yet
documented, and it generally undergoes less testing.
@@ -21,13 +21,13 @@ For the software Layerscape Debian Linux SDK User Guide, see:
- https://www.nxp.com/docs/en/user-guide/UG10143.pdf
The components from NXP are:
- rcw, lf-6.18.20-2.0.0
- atf (fork), lf-6.18.20-2.0.0
- uboot (fork), lf-6.18.20-2.0.0
- qoriq-fm-ucode (blob), lf-6.18.20-2.0.0
- linux (fork), lf-6.18.20-2.0.0
- fmlib, lf-6.18.20-2.0.0
- fmc, lf-6.18.20-2.0.0
- rcw, lf-6.12.34-2.1.0
- atf (fork), lf-6.12.34-2.1.0
- uboot (fork), lf-6.12.34-2.1.0
- qoriq-fm-ucode (blob), lf-6.12.34-2.1.0
- linux (fork), lf-6.12.34-2.1.0
- fmlib, lf-6.12.34-2.1.0
- fmc, lf-6.12.34-2.1.0
Build
=====

View File

@@ -0,0 +1 @@
../linux/linux.hash

View File

@@ -1,2 +1,2 @@
# From https://www.kernel.org/pub/linux/kernel/v6.x/sha256sums.asc
sha256 f4855f382c1b735c84072bdef36db5bcd5dc7b0c37e42f5104317149a0a486ef linux-6.18.18.tar.xz
# Locally calculated
sha256 93218296934915636fe6ba08e125948424cc270fd8948502c0ab91087a9fccd8 linux-6.6.44.tar.xz

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 b60d5865cefdbc75da8da4156c56c458e00de75a49b80c1a2e58a96e30ad0d54 u-boot-2026.01.tar.bz2
sha256 f591da9ab90ef3d6b3d173766d0ddff90c4ed7330680897486117df390d83c8f u-boot-2024.07.tar.bz2

View File

@@ -1,2 +0,0 @@
# From https://www.kernel.org/pub/linux/kernel/v6.x/sha256sums.asc
sha256 f4855f382c1b735c84072bdef36db5bcd5dc7b0c37e42f5104317149a0a486ef linux-6.18.18.tar.xz

View File

@@ -1,2 +0,0 @@
# Locally calculated
sha256 b60d5865cefdbc75da8da4156c56c458e00de75a49b80c1a2e58a96e30ad0d54 u-boot-2026.01.tar.bz2

View File

@@ -27,6 +27,7 @@ image sdcard.img {
partition rootfs {
partition-type = 0x83
image = "rootfs.ext2"
size = 128M
offset = 0
}
}

View File

@@ -1,2 +0,0 @@
# From https://www.kernel.org/pub/linux/kernel/v6.x/sha256sums.asc
sha256 7c716216c3c4134ed0de69195701e677577bbcdd3979f331c182acd06bf2f170 linux-6.18.15.tar.xz

View File

@@ -1,2 +0,0 @@
# Locally calculated
sha256 b60d5865cefdbc75da8da4156c56c458e00de75a49b80c1a2e58a96e30ad0d54 u-boot-2026.01.tar.bz2

Some files were not shown because too many files have changed in this diff Show More