Commit Graph

77925 Commits

Author SHA1 Message Date
Thomas Petazzoni
9a4ef6c282 package/rpi-firmware: drop support for vcdbg
This tool has been removed from upstream rpi-firmware, so drop the
corresponding option and logic in rpi-firmware.mk.

The tool has been removed by upstream commit
d1fcc26038186aecc1501a0b749833300afba801 ("opt: Remove builds of
deprectated userland tools").

It is Buildorot commit
28e6953ba8 ("package/rpi-firmware: bump
version to 5476720") that did a bump to a version of rpi-firmware that
no longer provided vcdbg.

Cc: Köry Maincent <kory.maincent@bootlin.com>
Cc: Gaël PORTAY <gael.portay@rtone.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Reviewed-by: Kory Maincent <kory.maincent@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f53a1af56b8cedda58038413cbb9e621ab01705a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:21:48 +01:00
Thomas Petazzoni
f777594d19 package/zxing-cpp: drop support for Python bindings
Since the bump of zxing-cpp to version 2.3.0 in Buildroot commit
fb032bd34a ("package/zxing-cpp: bump to
version 2.3.0"), the build of the Python bindings has been broken. We
tried to figure things out, but couldn't, and nobody bothered fixing
this since February 2025, so let's drop support for the Python
bindings for the time being.

Fixes:

  https://autobuild.buildroot.net/results/93ffa69b9f92f142c65169f9c3a7c7ad0e733551/

Cc: Thomas Bonnefille <thomas.bonnefille@bootlin.com>
Cc: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f78163431c4ea5a7d8aa083639fc5435d8d64957)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:20:07 +01:00
Thomas Petazzoni
32dcee9454 package/python-pyqt5: disable qt5webkit module
Due to issues in the installation of qt5webkit, building the
corresponding Python binding fails:

Project ERROR: Unknown module(s) in QT: webkit
Error: /home/thomas/buildroot/br/output-all/host/bin/qmake failed to create a
makefile from PyQt5.pro.
make[1]: *** [package/pkg-generic.mk:263: /home/thomas/buildroot/br/output-all/build/python-pyqt5-5.15.6/.stamp_configured] Error 1
make: *** [Makefile:83: _all] Error 2

https://lore.kernel.org/buildroot/20220929181350.1026033-1-thomas.ballasi@savoirfairelinux.com/
was an attempt at fixing it, but this patch doesn't work and looks
weird.

So for the time being, disable the Webkit module in python-pyqt5. This
issue has indeed been around for as far as 2022.

Fixes:

  https://autobuild.buildroot.net/results/b9d69d21e734aa62a6e0b4d4124c2bcfc027ebe4/

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit b3e9dc303e0fb883c42954f9eaf3fe70001bd714)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:17:44 +01:00
Thomas Petazzoni
fdfd19dc15 package/qt5/qt5webkit: fix gcc >= 14.x build issue
Add another patch from Fedora, also used in Arch Linux to fix a gcc >=
14.x build issue:

build/qt5webkit-5.212.0-alpha4/Source/WebCore/page/csp/ContentSecurityPolicy.cpp:235:56:   required from here
  235 |             if ((policy.get()->*allowed)(std::make_pair(algorithm, digest)))
      |                                          ~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~
host/opt/ext-toolchain/aarch64-buildroot-linux-gnu/include/c++/14.3.0/type_traits:1246:52: error: non-constant
condition for static assertion
 1246 |       static_assert(std::__is_complete_or_unbounded(__type_identity<_Tp>{}),
      |                     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit b79eb5a28f50b54078eff5c92fb2c00ac05a2882)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:17:24 +01:00
Thomas Petazzoni
3d13a6de73 package/qt5/qt5webkit: add patch to fix missing <cstdint> include
It is not clear which change introduce this breakage, but we suspect
it is related to GCC 14.x. In any case, the fix does no harm and is
good to backport to 2025.02.x.

Fixes:

/home/thomas/buildroot/br/output-all/build/qt5webkit-5.212.0-alpha4/Source/ThirdParty/ANGLE/src/common/mathutil.h:575:8: error: ‘uint32_t’ does not name a type
  575 | inline uint32_t RotL(uint32_t x, int8_t r)
      |        ^~~~~~~~
/home/thomas/buildroot/br/output-all/build/qt5webkit-5.212.0-alpha4/Source/ThirdParty/ANGLE/src/common/mathutil.h:19:1: note: ‘uint32_t’ is defined in header ‘<cstdint>’; this is probably fixable by adding ‘#include <cstdint>’
   18 | #include <stdlib.h>
  +++ |+#include <cstdint>
   19 |

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d10726a1a1c60f934ef7022d188eb231ea174fb0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:17:12 +01:00
Bernd Kuhls
b33e415990 package/ledmon: update patch to fix musl build
Updated patch following an upstream review:
https://github.com/md-raid-utilities/ledmon/pull/272#issuecomment-3596495739

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit b4668eded3d8087600f3aa67c2d354edfa7ce97e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:13:40 +01:00
Fiona Klute
3eac10574c package/apache: fix checkpackage warnings in init script
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 3862abb010f0ab923a9d870411dc38cc5d5e5f22)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:11:55 +01:00
Bernd Kuhls
55ce2b60c3 package/utfcpp: fix comments
Buildroot commit dc55e7eb51 added this
package as copy from the taglib package but forgot to change all taglib-
related comments.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit b7b96c97f9714baed16e23059d703facbdf155f4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:10:42 +01:00
Bernd Kuhls
3076134c1c package/libupnp: disable blocking-tcp
Suggested by Gerbera:
fcf3147223

CMake Warning at CMakeLists.txt:583 (message):
  !! It is strongly recommended to build libupnp with --disable-blocking-tcp-connections !!
  Without this option non-responsive control points can cause libupnp to hang.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 48c1e7cc6da96b12c8c8eb59c49cb917b0ae1a43)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:09:01 +01:00
Thomas Perale
2f5143824b package/cmake: remove stale IGNORE_CVES
Since Buildroot commit [1] the CVEs are no longer matched to CPEs with
versions using '-'.

These IGNORE_CVES entry introduced in [2] is then no longer matched to
the cmake package.

For more information, see the explanation in commit [1].

[1] 35f376d88e support/scripts/cve.py: fix CPE matching
[2] 5ce1e773b9 package/cmake: ignore CVE-2016-10642

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit ac47f65186d775ae98fda7429e007ff59e278c51)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:04:38 +01:00
Thomas Perale
72fc25bba7 package/dovecot: remove stale IGNORE_CVES
Since Buildroot commit [1] the CVEs are no longer matched to CPEs with
versions using '-'.

These IGNORE_CVES entry introduced in [2] is then no longer matched to
the dovecot package.

For more information, see the explanation in commit [1].

[1] 35f376d88e support/scripts/cve.py: fix CPE matching
[2] 948e71689a package/dovecot: ignore CVE-2016-4983

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 9dbd14df2291b5c6566d7fcd73c3934b931aed1a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:04:31 +01:00
Thomas Perale
503adba18a package/freerdp: remove stale IGNORE_CVES
The NVD DB is now correctly tracking the vulnerability starting version
3.0 (see [1]). The IGNORE_CVES entry introduced in [2] is then no longer
needed.

[1] https://nvd.nist.gov/vuln/detail/CVE-2025-4478
[2] f741e8f6e6 package/freerdp: ignore CVE-2025-4478

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit b3007ebcaf4736dde948a43ea6f8abee6b83c8c5)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:04:24 +01:00
Thomas Perale
ad4df54b84 package/glibc: remove stale IGNORE_CVES
Since Buildroot commit [1] the CVEs are no longer matched to CPEs with
versions using '-'.

These IGNORE_CVES entries introduced in [2] are then no longer matched to
the glibc package.

For more information, see the explanation in commit [1].

[1] 35f376d88e support/scripts/cve.py: fix CPE matching
[2] adaae82c58 package/glibc: ignore CVEs not considered as security issues by upstream

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 9383a3a72667523c691b7898691bd168bab87839)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:04:10 +01:00
Thomas Perale
3c88e7efaa boot/grub2: remove stale IGNORE_CVES
Since Buildroot commit [1] the CVEs are no longer matched to CPEs with
versions using '-'.

The IGNORE_CVES entries introduced in [2][3][4] are then no longer
matched to the grub2 package.

For more information, see the explanation in commit [1].

[1] 35f376d88e support/scripts/cve.py: fix CPE matching
[2] 2495630383 boot/grub2: ignore CVE-2024-1048
[3] e2f46ed03d boot/grub2: ignore CVE-2023-4001
[4] a490687571 boot/grub2: ignore the last 3 remaining CVEs

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 2a2184f317faa41049cba4095fde42e87628091e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:04:02 +01:00
Thomas Perale
1b63d0ba08 package/libcurl: remove stale IGNORE_CVES
Since Buildroot commit [1] the CVEs are no longer matched to CPEs with
versions using '-'.

The CVE-2024-32928 introduced in [2] is then no longer matched to the
libcurl package.

For more information, see the explanation in commit [1].

[1] 35f376d88e support/scripts/cve.py: fix CPE matching
[2] 7e739d49b2 package/libcurl: ignore CVE-2024-32928

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit b155395a52e50327db98e9bcfc62410e5eb109cd)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:03:54 +01:00
Thomas Perale
66bc81b5c1 package/libssh: remove stale IGNORE_CVES
The entry was added in commit [1]. But since then the NVD database
updated the version end specifier.

This IGNORE_CVES entry is then no longer needed.

[1] 51b1e1daf5 package/libssh: ignore CVE-2025-5318

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 4aacd22a856d31517dec88f9677693af9e60e030)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:03:44 +01:00
Thomas Perale
8b87f2597b package/pixman: remove stale IGNORE_CVES
Since Buildroot commit [1] the CVEs are no longer matched to CPEs with
versions using '-'.

The CVE-2023-37769 is then no longer matched to the pixman package.

For more information, see the explanation in commit [1].

[1] 35f376d88e support/scripts/cve.py: fix CPE matching

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 5043af53edea237dab1d5334b263cc9245d44404)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:03:36 +01:00
Thomas Perale
e7918ae91a package/postgresql: remove stale IGNORE_CVES
Since Buildroot commit [1] the CVEs are no longer matched to CPEs with
versions using '-'.

The CVE-2017-8806 is then no longer matched to the postgresql package.

For more information, see the explanation in commit [1].

[1] 35f376d88e support/scripts/cve.py: fix CPE matching

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Reviewed-by: Maxim Kochetkov <fido_max@inbox.ru>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit b1ca8ca4ba4814dfa11e840cc94341d966a6e911)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:03:25 +01:00
Thomas Perale
90a58c761c package/rsyslog: remove stale IGNORE_CVES
Since Buildroot commit [1] the CVEs are no longer matched to CPEs with
versions using '-'.

The CVE-2015-3243 is then no longer matched to the rsyslog package.

For more information, see the explanation in commit [1].

[1] 35f376d88e support/scripts/cve.py: fix CPE matching

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 1e48fde1cbe62cbb486eaa0ea99d85762ebc74f3)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:03:19 +01:00
Thomas Perale
aba6ad016d package/tiff: remove stale IGNORE_CVES
The Buildroot commit [1] introduced this IGNORE_CVES entry that was due
to a bad NVD entry.

The NVD database has now fixed the annotation [2] and it can be removed.

[1] 740412aefc package/tiff: ignore CVE-2025-8851
[2] https://nvd.nist.gov/vuln/detail/CVE-2025-8851

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 237cd294b7bbe7c42e621042bef4756724d2c233)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:03:11 +01:00
Thomas Perale
fe357abb84 package/patch: add CVE trailer in patches
Since Buildroot commit [1] the patches that fixes a security
vulnerability needs to reference the fixed vulnerability.

This patch adds the relevant information to the patches header as well
as the `Upstream` trailer.

[1] 1167d0ff3d docs/manual: mention CVE trailer

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 74b079d9e916062629148ba79374998762e1998a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:03:05 +01:00
Thomas Perale
d23ec514a8 package/shellinabox: add CVE trailer in patch
Since Buildroot commit [1] the patches that fixes a security
vulnerability needs to reference the fixed vulnerability.

This patch adds the relevant information to the patch header
and adds the `Upstream` trailer.

[1] 1167d0ff3d docs/manual: mention CVE trailer

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 7c9166cd86a4d984d019996b58d7a68052a1639f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:02:59 +01:00
Thomas Perale
f81cb193a8 package/xinetd: add CVE trailer in patch
Since Buildroot commit [1] the patches that fixes a security
vulnerability needs to reference the fixed vulnerability.

This patch adds the relevant information to the patch header
and adds the `Upstream` trailer.

[1] 1167d0ff3d docs/manual: mention CVE trailer

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 7a8524a70173953e3a8a11456d25ec3fea347153)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:02:52 +01:00
Bernd Kuhls
f7dec4b0d2 package/liburiparser: security bump version to 1.0.0
https://github.com/uriparser/uriparser/blob/uriparser-1.0.0/ChangeLog

Added sha256 hash provided by upstream.

Fixes CVE-2025-67899.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 3ef90e752b4c3eb35c2715bde8750cb9ed3005fb)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:02:40 +01:00
Bernd Kuhls
34399ef8c2 package/liburiparser: bump version to 0.9.9
Changelog:
https://github.com/uriparser/uriparser/blob/uriparser-0.9.9/ChangeLog

Renamed license file due to upstream commit:
460ff9e573

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 74214bd80e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:02:34 +01:00
Pierre-Yves Kerbrat
df3818dff9 package/imagemagick: security bump to 7.1.2-12
Changelog:
https://github.com/ImageMagick/Website/blob/main/ChangeLog.md

CVE-2025-66628:

    In versions 7.1.2-9 and prior, the TIM (PSX TIM) image parser
    contains a critical integer overflow vulnerability in its
    ReadTIMImage function (coders/tim.c).

    For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2025-66628

Signed-off-by: Pierre-Yves Kerbrat <pkerbrat@free.fr>
[Julien: mark commit as security related and add cve info]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 4a315e153f120ff236f1dd63d9e097e169918c23)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:00:53 +01:00
Alexis Lothoré
4374b541aa packages/linux-tools: perf: enforce PKG_CONFIG_LIBDIR
For kernel patched with 440cf77625e3 ("perf: build: Setup
PKG_CONFIG_LIBDIR for cross compilation"), if neither PKG_CONFIG_LIBDIR,
PKG_CONFIG_PATH nor PKG_CONFIG_SYSROOT_DIR are provided, the perf
Makefile while try to set some default value for PKG_CONFIG_LIBDIR,
which will not point correctly to buildroot staging directory. This
issue will lead for example to a failure to find libtraceevent even
if it is correctly enabled and installed in the staging dir, and so it
will make perf fail to build.

Make sure to call the perf make command with PKG_CONFIG_LIBDIR variable
set and pointing to buildroot staging area to make sure to properly
detect perf dependencies.

Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Tested-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f784c823ef8357aa36828342f83d5fd59995937e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:00:32 +01:00
Alexis Lothoré
dbdae1cda2 package/linux-tools: perf: build with libtraceevent support when it is selected
When trying to perform a custom uprobe recording on a target with perf
built by buildroot, the recording step fails as perf can not record
uprobes without libtraceevent support:

  $ perf probe -x linked_list insert_name index
  Target program is compiled without optimization. Skipping prologue.
  Probe on address 0x808 to force probing at the function entry.

  Added new event:
    probe_linked_list:insert_name (on insert_name in /root/gdb/linked_list with index)

  perf is not linked with libtraceevent, to use the new probe you can use tracefs:

          cd /sys/kernel/tracing/
          echo 1 > events/probe_linked_list/insert_name/enable
          echo 1 > tracing_on
          cat trace_pipe
          Before removing the probe, echo 0 > events/probe_linked_list/insert_name/enable
  $ perf record -e probe_linked_list:insert_name ./linked_list
  event syntax error: 'probe_linked_list:insert_name'
                       \___ unsupported tracepoint

  libtraceevent is necessary for tracepoint support
  Run 'perf list' for a list of valid events

   Usage: perf record [<options>] [<command>]
      or: perf record [<options>] -- <command> [<options>]

      -e, --event <event>   event selector. use 'perf list' to list available events

libtraceevent support for perf has been disabled with commit
b4ab45a5c1 ("package/linux-tools: disable libtracevent detection")
because there was no libtraceevent package in buildroot to replace the
former libtraceevent removed from the kernel sources. Since then, commit
1474f1b34b ("package/libtraceevent: new package") has introduced a
libtraceevent package. We can then expose again the possibility to build
perf with libtraceevent support.

Make buildroot perf makefile detect if libtraceevent package has been
enabled, and if so, allow to build perf with libtraceevent support.

Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Tested-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 5396f730d7f77c572a67993ef139ed735650398f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 15:58:08 +01:00
Dario Binacchi
4096db6b07 package/embiggen-disk: fix EMBIGGEN_DISK_VERSION
Make EMBIGGEN_DISK_VERSION compliant with release-monitoring.org.

Fixes: 4ae18c511a
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Reviewed-by: Christian Stewart <christian@aperture.us>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 9824b964a7db1a69885ddbfefc40663d591dc653)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 15:57:46 +01:00
Thomas Perale
4d2210dcfa package/libfreeimage: various vulnerability patches
This package’s last release dates back to July 2018. Since then, a
number of CVEs have accumulated. This patch applies several
vulnerability fixes from the Fedora project. Not all vulnerabilities are
addressed by this patch.

- CVE-2019-12211

    When FreeImage 3.18.0 reads a tiff file, it will be handed to the
    Load function of the PluginTIFF.cpp file, but a memcpy occurs in
    which the destination address and the size of the copied data are
    not considered, resulting in a heap overflow.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2019-12211

- CVE-2019-12213

    When FreeImage 3.18.0 reads a special TIFF file, the
    TIFFReadDirectory function in PluginTIFF.cpp always returns 1,
    leading to stack exhaustion.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2019-12213

- CVE-2020-24292

    Buffer Overflow vulnerability in load function in PluginICO.cpp in
    FreeImage 3.19.0 [r1859] allows remote attackers to run arbitrary
    code via opening of crafted ico file.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2020-24292
  - https://sourceforge.net/p/freeimage/discussion/36111/thread/afb98701eb/

- CVE-2020-24293

    Buffer Overflow vulnerability in psdThumbnail::Read in PSDParser.cpp
    in FreeImage 3.19.0 [r1859] allows remote attackers to run arbitrary
    code via opening of crafted psd file.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2020-24293
  - https://sourceforge.net/p/freeimage/discussion/36111/thread/afb98701eb/

- CVE-2020-24295

    Buffer Overflow vulnerability in PSDParser.cpp::ReadImageLine() in
    FreeImage 3.19.0 [r1859] allows remote attackers to ru narbitrary
    code via use of crafted psd file.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2020-24295
  - https://sourceforge.net/p/freeimage/discussion/36111/thread/afb98701eb/

- CVE-2021-33367

    Buffer Overflow vulnerability in Freeimage v3.18.0 allows attacker
    to cause a denial of service via a crafted JXR file.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2021-33367
  - https://sourceforge.net/p/freeimage/discussion/36109/thread/1a4db03d58/

- CVE-2021-40263

    A heap overflow vulnerability in FreeImage 1.18.0 via the ofLoad
    function in PluginTIFF.cpp.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2021-40263
  - https://sourceforge.net/p/freeimage/bugs/336/

- CVE-2021-40266

    FreeImage before 1.18.0, ReadPalette function in PluginTIFF.cpp is
    vulnerabile to null pointer dereference.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2021-40266
  - https://sourceforge.net/p/freeimage/bugs/334/

- CVE-2023-47995

    Memory Allocation with Excessive Size Value discovered in
    BitmapAccess.cpp::FreeImage_AllocateBitmap in FreeImage 3.18.0
    allows attackers to cause a denial of service.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2023-47995

- CVE-2023-47997

    An issue discovered in BitmapAccess.cpp::FreeImage_AllocateBitmap in
    FreeImage 3.18.0 leads to an infinite loop and allows attackers to
    cause a denial of service.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2023-47997

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 6750719a20ff58bba61936320ce4c76b02eefc7a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 15:56:31 +01:00
Thomas Perale
3f9e201663 package/pixman: fix patch reference in IGNORE_CVES
Since Buildroot commit [1] the
`0001-Disable-tests.patch` patch reference
was removed in favour of a build argument that disable the tests.

This update the reference in IGNORE_CVES accordingly.

[1] ba2fb599cd package/pixman: bump to version 0.44.2

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit f276648692b898aed8b32d4887a8372209b3cd2c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-06 09:19:44 +01:00
Thomas Perale
9cb5a7f690 package/sdl: fix patch reference in IGNORE_CVES
Since Buildroot commit [1] the
`0003-SDL_x11yuv.c-fix-possible-use-after-free.patch` patch reference
was renamed.

This update the reference in IGNORE_CVES accordingly.

[1] 9fab7bb79d package/sdl: drop directfb support

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit d372b654a45882f641ff65a4acf7126e66c35487)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-06 09:19:42 +01:00
Thomas Perale
23ccc3ab5c package/sdl: add CVE trailer in patch
Since Buildroot commit [1] the patches that fixes a security
vulnerability needs to reference the fixed vulnerability.

This patch adds the relevant information to the patch header.

[1] 1167d0ff3d docs/manual: mention CVE trailer

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit ee647574b7c8cc662937a312c6d20f555db777af)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-06 09:19:40 +01:00
Thomas Perale
288e04ed50 package/libtomcrypt: add CVE trailer in patch
Since Buildroot commit [1] the patches that fixes a security
vulnerability needs to reference the fixed vulnerability.

This patch adds the relevant information to the patch header.

[1] 1167d0ff3d docs/manual: mention CVE trailer

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 9265e6973593240104c8f9e2a675c01c6c8e37a3)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-06 09:19:38 +01:00
Thomas Perale
e278e4a68e package/libconfuse: add CVE trailer in patch
Since Buildroot commit [1] the patches that fixes a security
vulnerability needs to reference the fixed vulnerability.

This patch adds the relevant information to the patch header
and adds the `Upstream` trailer.

[1] 1167d0ff3d docs/manual: mention CVE trailer

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit ba51d53019bbc6f862b87389a90695a3dbe0670c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-06 09:19:36 +01:00
Thomas Perale
7f97279529 package/cups-filter: add CVE trailer in patch
Since Buildroot commit [1] the patches that fixes a security
vulnerability needs to reference the fixed vulnerability.

This patch adds the relevant information to the patch header.

[1] 1167d0ff3d docs/manual: mention CVE trailer

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit c9b63b439c06c6bf485ff17dcf4477caded2d40e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-06 09:19:34 +01:00
Thomas Perale
608cd41931 package/avahi: add CVE trailer in patch
Since Buildroot commit [1] the patches that fixes a security
vulnerability needs to reference the fixed vulnerability.

This patch adds the relevant information to the patch header
and adds the `Upstream` trailer.

[1] 1167d0ff3d docs/manual: mention CVE trailer

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit cef136b5f09827a8d1e98a0dce0380449ed61cd4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-06 09:19:32 +01:00
Thomas Perale
cbe5ba25c0 package/dovecot: add CVE trailer in patch
Since Buildroot commit [1] the patches that fixes a security
vulnerability needs to reference the fixed vulnerability.

This patch adds the relevant information to the patch header.

[1] 1167d0ff3d docs/manual: mention CVE trailer

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit eb0dde58b3f0fa6cd3120343094634fc8a13412d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-06 09:19:30 +01:00
Thomas Perale
0be4ecbd7e package/lua-http: add CVE trailer in patch
Since Buildroot commit [1] the patches that fixes a security
vulnerability needs to reference the fixed vulnerability.

This patch adds the relevant information to the patch header.

[1] 1167d0ff3d docs/manual: mention CVE trailer

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 848d7dc51f1ce2576cb071b0f91063e4687cc088)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-06 09:19:28 +01:00
Thomas Perale
41af746500 package/opusfile: add CVE trailer in patch
Since Buildroot commit [1] the patches that fixes a security
vulnerability needs to reference the fixed vulnerability.

This patch adds the relevant information to the patch header.

[1] 1167d0ff3d docs/manual: mention CVE trailer

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 0b76139aa90828b3d58adc5853e1fddbe102b2a7)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-06 09:19:26 +01:00
Thomas Perale
3f3185e060 package/tinyxml: add CVE trailer in patch
Since Buildroot commit [1] the patches that fixes a security
vulnerability needs to reference the fixed vulnerability.

This patch adds the relevant information to the patch header
and adds the `Upstream` trailer.

[1] 1167d0ff3d docs/manual: mention CVE trailer

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 7b8c58ae03f87e047c14585b16de19c66b8344c8)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-06 09:19:24 +01:00
Thomas Perale
86215951ee package/x11vnc: add CVE trailer in patch
Since Buildroot commit [1] the patches that fixes a security
vulnerability needs to reference the fixed vulnerability.

This patch adds the relevant information to the patch header.

[1] 1167d0ff3d docs/manual: mention CVE trailer

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 6244163284a05ae38a819abcb7b65e03b04102dd)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-06 09:19:22 +01:00
Thomas Perale
2f7a2dcdd2 package/sox: add CVE trailer in patches
Since Buildroot commit [1] the patches that fixes a security
vulnerability needs to reference the fixed vulnerability.

This patch adds the relevant information to the patches header.

[1] 1167d0ff3d docs/manual: mention CVE trailer

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 9d0e4db4c458ebe202b32f52ca96ca2e3386a1b6)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-06 09:19:20 +01:00
Francois Perrad
f27cf0d09a package/collectl: switch to GitHub
development no longer on https://sourceforge.net/projects/collectl/
but documentation still on https://collectl.sourceforge.net/

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f8b9a50a0e6579abacdacdb920cfbde26347f5f9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-06 09:19:18 +01:00
Thomas Petazzoni
6d92d9ae99 package/vim: fix reinstallation with a patch
In commit 67e84345c156170fa01103289f1d255a74ad830d ("package/vim: fix
reinstallation"), we fixed the reinstallation of vim for the target
package by removing symlinks before calling "make installlinks".

However, this didn't fix the same problem for the host-vim package.

So instead, this commit adds a patch, accepted upstream, that uses "ln
-sf" instead of "ln -s" to create the symlinks, allowing them to be
overwriten on reinstallation.

Fixes:

ln: failed to create symbolic link 'view': File exists

on reinstallation of host-vim.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit ee656a4486cecc24dc424e4de62ca6c185432d0b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-06 09:19:16 +01:00
Julien Olivain
c24744dcbc support/testing: new kvmtool runtime test
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 577a2a32af0ef88321cf147b88cfecdbe17c9b4f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-06 09:19:14 +01:00
Julien Olivain
50c14b41fc package/kvmtool: remove unneeded KVMTOOL_EXTRA_LDFLAGS
Buildroot commit [1] "kvmtool: bump to f77d646ba0" removed the
definition of KVMTOOL_EXTRA_LDFLAGS but forgot to remove its usage
in KVMTOOL_MAKE_OPTS.

This commit removes it since it is no longer needed.

[1] f20615b53e

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 443307ef50e0a5b14b095178b7c8d59ad3639ab4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-06 09:19:12 +01:00
Julien Olivain
5151492c6c support/testing: ltp-testsuite: replace runltp by kirk
The run log of this ltp-testsuite test shows:

    INFO: runltp script is deprecated, try kirk
    https://github.com/linux-test-project/kirk

This commit updates this test to replace this deprecated runltp
shell script with the newer kirk Python script.

The logic of this runtime test remains the same: it runs a small number
of 'read' system call tests, and checks there is no failures and at
least one test succeed.

Cc: Petr Vorel <petr.vorel@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Acked-by: Petr Vorel <petr.vorel@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 43e254a646a2780e8e76171ba9318e5f5dc36fb2)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-06 09:19:10 +01:00
Bernd Kuhls
e9a1ee4d5e DEVELOPERS: add Bernd Kuhls for libid3tag
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 023c735f428e1836587b9370e4c039a70543a9dc)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-06 09:19:08 +01:00
Bernd Kuhls
be484f7770 package/python-pysnmp-mibs: update tarball URL
Updated package as computed by scanpypi.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit d0900ca523fe5a32832351520d504619650d269c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-06 09:19:06 +01:00