81471 Commits

Author SHA1 Message Date
Giulio Benetti
d5ff9792ab package/harfbuzz: bump version to 13.2.1
https://github.com/harfbuzz/harfbuzz/blob/13.2.1/NEWS

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-19 21:56:37 +01:00
Julien Olivain
f163d20002 support/testing: test_aichat: improve test reliability
Since llama.cpp update in Buildroot commit [1], the test_aichat can
fail for several reasons:

The loop checking for the llama-server availability can fail if curl
succeed, but the returned json data is not formatted as expected.
This can happen if the server is ready but the model is not completely
loaded. In that case, the server returns:

    {"error":{"message":"Loading model","type":"unavailable_error","code":503}}

This commit ignore Python KeyError exceptions while doing the
server test, to avoid failing if this message is received.

Also, this new llama-server version introduced a prompt caching, which
uses too much memory. This commit completely disable this prompt
caching by adding "--cache-ram 0" in the llama-server options.

[1] 05c36d5d87

Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-19 21:54:12 +01:00
Chen Pei
01a5a8be46 DEVELOPERS: Add Chen Pei to ndctl
Signed-off-by: Chen Pei <cp0613@linux.alibaba.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-19 21:47:13 +01:00
Chen Pei
039c1ae13e package/ndctl: new package
A "device memory" enabling project encompassing tools and
libraries for CXL, NVDIMMs, DAX, memory tiering and other
platform memory device topics.

ndctl is using __struct_group() [1] which was introduced in
kernel headers in upstream commit [2], first included in v5.16.
The commit [2] was backported in v5.15.54 in [3] and v5.10.156
in [4]. Therefore, this commits sets the minimal toolchain headers
version requirement to 5.10.

[1] https://github.com/pmem/ndctl/blob/v83/cxl/fwctl/features.h#L108
[2] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=50d7bd38c3aafc4749e05e8d7fcb616979143602
[3] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=d57ab893cdf8046cbe4d49746f9418020f788b1f
[4] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=9fd7bdaffe0e89833f4b1c1d3abd43023e951ec1

Signed-off-by: Chen Pei <cp0613@linux.alibaba.com>
[Julien:
  - add commit log info about __struct_group()
  - add __struct_group() comment in Config.in
  - relax toolchain headers requirements to 5.10
  - sort BR2_PACKAGE_ blocks in .mk alphabetically
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-19 21:45:52 +01:00
Bernd Kuhls
67e982e782 package/{mesa3d, mesa3d-headers}: bump version to 26.0.3
https://lists.freedesktop.org/archives/mesa-announce/2026-March/000842.html

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-18 22:43:55 +01:00
Bernd Kuhls
763b9c289e package/expat: security bump version to 2.7.5
https://github.com/libexpat/libexpat/blob/R_2_7_5/expat/Changes

Fixes CVE-2026-32776, CVE-2026-32777 & CVE-2026-32778.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-18 22:39:43 +01:00
Joseph Kogut
05c36d5d87 package/llama-cpp: bump to version b8117
Release notes: https://github.com/ggml-org/llama.cpp/releases

Merge BR2_PACKAGE_LLAMA_CPP_SERVER into BR2_PACKAGE_LLAMA_CPP_TOOLS, as
both of these options must be enabled to build tools like llama-cli and
llama-server. See upstream commit [1].

Since the Buildroot option BR2_PACKAGE_LLAMA_CPP_SERVER is removed, this
commit also removes it from support/testing/tests/package/test_aichat.py
which was using it.

[1] a180ba78c7

Signed-off-by: Joseph Kogut <joseph.kogut@gmail.com>
[Julien:
 - reindent options in .mk
 - remove BR2_PACKAGE_LLAMA_CPP_SERVER in test_aichat.py
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-18 22:01:23 +01:00
Bernd Kuhls
5e78c6cf33 package/snort3: bump version to 3.11.1.0
https://github.com/snort3/snort3/blob/3.11.1.0/ChangeLog.md

Removed patch which is included in this release.

Upstream switched from pcre to pcre2:
bb80b5d754

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2026-03-18 21:30:47 +01:00
Bernd Kuhls
79cef8416e package/daq3: bump version to 3.0.25
https://github.com/snort3/libdaq/releases

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2026-03-18 21:30:18 +01:00
Bernd Kuhls
256490256b package/kodi-pvr-zattoo: bump version to 21.0.5-Omega
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2026-03-18 21:28:32 +01:00
Kory Maincent
63364f0814 package/drm-info: new package
drm_info is a small utility to dump info about DRM devices.

Link: https://gitlab.freedesktop.org/emersion/drm_info
Signed-off-by: Kory Maincent <kory.maincent@bootlin.com>
[Julien:
 - sort selected packages in Config.in alphabetically
 - remove comment for license in hash file
 - move "v" from _VERSION to _SITE
 - switch _SITE to use gitlab release archives and add _SOURCE
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-18 19:31:36 +01:00
Mattias Walström
f341554ee6 package/frr: Bump version to 10.5.3
For change log since v10.5.1, see:
https://github.com/FRRouting/frr/releases/tag/frr-10.5.2
https://github.com/FRRouting/frr/releases/tag/frr-10.5.3

Signed-off-by: Mattias Walström <lazzer@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-18 19:13:21 +01:00
Neal Frager
75f62dc669 package/bootgen: fix build issue if host-flex already built
Fix a silent build issue with the host-bootgen package if host-flex is already
built. The host-flex package will install a version of the flexlexer.h header
file that is not compatible with the version embedded in bootgen.

While the build will still 'succeed', the binary will not be correct. This
can be seen by just running the binary that is built. By default, running
bootgen without any parameters should print the help menu, but if the wrong
version of flexlexer.h is used, it will print the following instead:

$ output/host/bin/bootgen

****** Bootgen v2025.1-Merged
  **** Build date : Mar 18 2026-07:08:01
    ** Copyright 1986-2022 Xilinx, Inc. All Rights Reserved.
    ** Copyright 2022-2025 Advanced Micro Devices, Inc. All Rights Reserved.

ERROR: syntax error
-h

Add a patch to the bootgen package that corrects the issue.

Upstream: CR to AMD jira

Signed-off-by: Neal Frager <neal.frager@amd.com>
Tested-by: Steven J. Hill <steven.hill@collins.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-18 19:11:22 +01:00
Francois Perrad
8c475011a8 package/janet: bump to version 1.41.2
For release notes, see:
https://github.com/janet-lang/janet/releases/tag/v1.41.1
https://github.com/janet-lang/janet/releases/tag/v1.41.2

This commit also updates the LICENCE hash, after year update:
6e4b0b9259

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
[Julien: add info in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-18 19:09:45 +01:00
Vincent Stehlé
0e8739fab2 package/xen: fix armv7 build with gcc-15
Backport a patch from Xen 4.21 to fix the following build errors for Arm v7
with gcc-15:

  xen-4.14.6/xen/include/asm/platforms/midway.h:1: error: header guard '__ASM_ARM_PLATFORMS_MIDWAY_H' followed by '#define' of a different macro [-Werror=header-guard]
  xen-4.14.6/xen/include/asm/platforms/omap5.h:1: error: header guard '__ASM_ARM_PLATFORMS_OMAP5_H' followed by '#define' of a different macro [-Werror=header-guard]

Since the external 32b arm toolchain has been updated to a version based on
gcc-15, the tests.package.test_xen.TestXenArmv7 python test does not build
anymore.
Adding the patch repairs it.

Link: https://gitlab.com/buildroot.org/buildroot/-/jobs/13518318473
Fixes: 86d453a7dc ("toolchain/toolchain-external/toolchain-external-arm-arm: bump to 15.2.rel1")
Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Cc: Alistair Francis <alistair@alistair23.me>
Cc: Dowan Gullient <dowan.gullient@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-18 19:06:55 +01:00
Manuel Diener
c26a70b524 package/uboot-tools: bump to version 2026.01
Signed-off-by: Manuel Diener <manuel.diener@oss.othermo.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-18 19:03:05 +01:00
Manuel Diener
de7bd5034b DEVELOPERS: add Manuel Diener to several packages
Add myself to packages recently orphaned which I am going to continue.

Signed-off-by: Manuel Diener <manuel.diener@oss.othermo.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-18 19:03:05 +01:00
Dario Binacchi
b538bf0218 package/armadillo: bump to version 15.2.4
Release notes:
https://arma.sourceforge.net/docs.html#changelog

Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-18 13:35:54 +01:00
Roberto Medina
cd2ba3ab0f configs/roc_pc_rk3399: Bump Linux, TF-A, U-Boot
- Bump Linux: 6.18.18
- Bump TF-A: v2.14
- Bump U-Boot: 2026.01
- Update hashes for relevant components

Signed-off-by: Roberto Medina <robertoxmed@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-18 13:01:37 +01:00
Giulio Benetti
ec58c67e5f configs/imxrt1050-evk: bump u-boot to fix the build and bump linux too
Python setuptools has removed the obsolete pkg_resources python module in
v82.0.0. This module is used by the binman command in U-Boot until
v2025.10.
Since the python-setuptools package has been updated to v82.0.0 in
Buildroot, the imxrt1050-evk_defconfig (using U-Boot v2025.07 and
binman) fails to build with the following error [1]:

  ModuleNotFoundError: No module named 'pkg_resources'

Update the defconfig to use a more recent U-Boot v2026.01, to fix the
build and at the same time bump Linux to version 6.18.18.

Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/13476922027

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
[Julien: fix defconfig name in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-18 13:01:37 +01:00
Dong Wang
367e9bb04b configs/friendlyarm_nanopi_r2s: bump to kernel 6.18.18 and U-Boot 2026.01
This commit:
- bumps the Linux kernel to 6.18.18
- bumps the U-Boot to 2026.01
- switches to a stable glibc Bootlin external toolchain
- enables force hashes check
- enlarge the rootfs size to 256M

The updated U-Boot should also fix the CI build of the board.

Fixes: https://gitlab.com/buildroot.org/buildroot/-/jobs/13458392713

Run-tested on the board.

Signed-off-by: Dong Wang <wangdong115@foxmail.com>
[Julien:
 - remove .checkpackageignore entry to fix check-package error
 - move uboot.hash in its correct directory
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-18 13:01:37 +01:00
Dong Wang
916331b917 configs/friendlyarm_nanopi_neo: bump to kernel 6.18.18 and U-Boot 2026.01
This commit:
- bumps the Linux kernel to 6.18.18
- bumps the U-Boot to 2026.01
- switches to a stable glibc Bootlin external toolchain

The updated U-Boot should also fix the CI build of the board.

Fixes: https://gitlab.com/buildroot.org/buildroot/-/jobs/13458392712

Run-tested on the board.

Signed-off-by: Dong Wang <wangdong115@foxmail.com>
[Julien: add missing BR2_TARGET_UBOOT_NEEDS_GNUTLS=y]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-18 13:01:37 +01:00
James Hilliard
c897438742 package/wpebackend-fdo: fix EGL_NOT_INITIALIZED crash
Commit 4cd4b2e1e6 updated mesa3d
past version 25.2.0 which deprecated the legacy wayland
EGL_WL_bind_wayland_display interface, as wpebackend-fdo
currently still relies on this functionality ensure that we
enable EGL_WL_bind_wayland_display in mesa3d.

Fixes:
 - https://lore.kernel.org/all/CADvTj4pYf0uymrkZUuWgahWK=pm5CgTJL5U+gwbwKExK1so5jA@mail.gmail.com/

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Acked-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
2026-03-17 22:51:06 +01:00
James Hilliard
0260741639 package/mesa3d: add EGL_WL_bind_wayland_display support
This feature was made optional in mesa3d 25.2.0 as it is deprecated,
however some packages still require it so lets add a new config
option that those packages can select until they no longer require
this feature.

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Reviewed-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
2026-03-17 22:50:52 +01:00
Fabien Lehoussel
3a5e70d1d1 support/scripts/generate-cyclonedx: add source attribute to CVEs
Add 'source' attribute to each CVE in vulnerabilities node, including NVD
URL reference to enable proper import into Dependency-Track.

Dependency-Track's VEX importer requires the source attribute to
properly process vulnerability entries. Without it, vulnerabilities are
skipped during import with "does not have an ID and / or source" warnings.

Include the full NVD URL following the CycloneDX 1.6 documentation format:
https://nvd.nist.gov/vuln/detail/{CVE-ID}

Test Environment:
- Buildroot: 2025.02.11 (or master)
- Dependency-Track: v4.13.6

Test Results - BEFORE (without source attribute):
apiserver_1  | 2026-02-23 16:05:40,890 INFO [VexUploadProcessingTask] Processing CycloneDX VEX uploaded to project: e43fe185-c0a3-4e3a-a908-667344a66a9c
apiserver_1  | 2026-02-23 16:05:40,941 WARN [CycloneDXVexImporter] VEX vulnerability at position #0 does not have an ID and / or source; Skipping it
apiserver_1  | 2026-02-23 16:05:40,941 WARN [CycloneDXVexImporter] VEX vulnerability at position #1 does not have an ID and / or source; Skipping it
...
apiserver_1  | 2026-02-23 16:05:40,941 WARN [CycloneDXVexImporter] VEX vulnerability at position #19 does not have an ID and / or source; Skipping it
apiserver_1  | 2026-02-23 16:05:40,941 INFO [CycloneDXVexImporter] The uploaded VEX does not contain any applicable vulnerabilities; Skipping VEX import

Test Results - AFTER (with source):
apiserver_1  | 2026-02-23 16:17:13,492 INFO [VexUploadProcessingTask] Processing CycloneDX VEX uploaded to project: e43fe185-c0a3-4e3a-a908-667344a66a9c
apiserver_1  | 2026-02-23 16:17:14,054 INFO [VexUploadProcessingTask] Completed processing of CycloneDX VEX for project: e43fe185-c0a3-4e3a-a908-667344a66a9c

CVEs are correctly imported in Dependency-Track

Signed-off-by: Fabien Lehoussel <fabien.lehoussel@smile.fr>
Acked-By: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
2026-03-17 22:13:20 +01:00
Fabien Lehoussel
ac466d4b1a cve-check: fix CVE URL format
Update NVD source to full URL format following CycloneDC 1.6
specification [1].

Before: "url": "https://nvd.nist.gov/"
After:  "url": "https://nvd.nist.gov/vuln/detail/CVE-XXXX"

[1] https://cyclonedx.org/docs/1.6/json/#vulnerabilities_items_source_url

Signed-off-by: Fabien Lehoussel <fabien.lehoussel@smile.fr>
Acked-By: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
2026-03-17 22:09:41 +01:00
Thomas Perale
4cc0e959ff CHANGES: update for 2025.11.3
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 91f60590fd)
2026-03-17 21:34:25 +01:00
Thomas Perale
a21946562b CHANGES: update for 2025.02.12
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 8e3c43d9cc)
2026-03-17 21:33:14 +01:00
Arnout Vandecappelle
b6cd846443 docs/website/{download,news}.html: update for 2025.02.12 and 2025.11.3
The 2025.11.x series was dropped with the 2026.02 release, so
(temporarily) re-add it. It will be dropped again with the 2026.02.1
release.

Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2026-03-17 21:27:09 +01:00
Flaviu Nistor
09bc5515fc package/python-rich: bump to version 14.3.3
Release notes:
https://github.com/Textualize/rich/releases/tag/v14.3.3

Signed-off-by: Flaviu Nistor <flaviu.nistor@gmail.com>
Reviewed-by: Fiona Klute <fiona.klute@gmx.de>
[Julien: add link to release notes]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-16 23:28:27 +01:00
Yann E. MORIN
e190962f3e package/python-humanfriendly: new package
Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Cc: Romain Naour <romain.naour@smile.fr>
Cc: James Hilliard <james.hilliard1@gmail.com>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Cc: Yegor Yefremov <yegorslists@googlemail.com>
[Julien:
 - add DEVELOPERS entry
 - fix test class name
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-16 22:34:53 +01:00
Giulio Benetti
49c1e1181f package/nfs-utils: bump version to 2.8.7
Release announce:
https://lore.kernel.org/linux-nfs/4d11b9d7-7b49-4a1e-8c26-29ecb2fefe2f@redhat.com/

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Reviewed-by: Petr Vorel <petr.vorel@gmail.com>
[Julien: remove "security" in commit title]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-16 22:17:56 +01:00
Waldemar Brodkorb
84bc50c82d package/uclibc: bump to 1.0.57
Following changes made it into the release:

Joris van Rantwijk (1):
      Fix adjtimex() with TIME64

Waldemar Brodkorb (8):
      sys/stat.h: remove _STAT_VER/_MKNOD_VER
      fix gettid() declaration
      add statx syscall wrapper
      sparc: add optimize build support for leon3
      sparc: sync with Linux kernel definition, fixes gdb compile
      fix compile error on earlier Kernels predating statx
      select: fix compilation failure with very old kernel
      bump version for 1.0.57 release

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-16 21:59:44 +01:00
Julien Olivain
b6884913ae package/zfs: add patch to fix build with uclibc >= 1.0.57
uclibc 1.0.57 added a statx() syscall wrapper in upstream commit [1].

zfs fail to build with uclibc 1.0.57 (not yet in Buildroot), because:
1. uclibc <fcntl.h> internally includes <sys/stat.h>, and
2. a zfs test redefines a statx() wrapper with a slightly different
   prototype.

In that case, zfs fails to compile with error:

    tests/zfs-tests/cmd/statx.c:58:1: error: conflicting types for 'statx'; have 'int(int,  const char *, int,  unsigned int,  void *)'

Issue has been reported upstream at [2].

This commit adds a package patch to fix that issue.

[1] d3a819aff2
[2] https://github.com/openzfs/zfs/pull/18316

Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-16 21:58:17 +01:00
Vincent Stehlé
fe49bf9451 configs/iot-gate-imx8_ebbr: bump u-boot to fix the build
Python setuptools has removed the obsolete pkg_resources python module in
v82.0.0. This module is used by the binman command in U-Boot until
v2025.10.
Since the python-setuptools package has been updated to v82.0.0 in
Buildroot, the iot-gate-imx8_ebbr_defconfig (using U-Boot v2025.07 and
binman) fails to build with the following error [1]:

  ModuleNotFoundError: No module named 'pkg_resources'

Update the defconfig to use a more recent U-Boot v2026.01, to fix the
build.

Link: https://gitlab.com/buildroot.org/buildroot/-/jobs/13476922237 [1]
Fixes: 51365ff063 ("package/python-setuptools: bump to version 82.0.0")
Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Cc: James Hilliard <james.hilliard1@gmail.com>
Cc: Julien Olivain <ju.o@free.fr>
[Julien: update custom uboot.hash file]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-16 21:54:13 +01:00
Vincent Stehlé
7428907828 support/testing: bump test_atf u-boot to fix the build
Python setuptools has removed the obsolete pkg_resources python module in
v82.0.0. This module is used by the binman command in U-Boot until
v2025.10.
Since the python-setuptools package has been updated to v82.0.0 in
Buildroot, the python test tests.boot.test_atf.TestATFAllwinner (using
U-Boot v2023.10 and binman) fails to build with the following error [1]:

  ModuleNotFoundError: No module named 'pkg_resources'

Update test_atf to use a more recent U-Boot v2026.01 (and add the
dependency on GNU TLS), to fix the build.

Link: https://gitlab.com/buildroot.org/buildroot/-/jobs/13500946337 [1]
Fixes: 51365ff063 ("package/python-setuptools: bump to version 82.0.0")
Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Cc: James Hilliard <james.hilliard1@gmail.com>
Cc: Julien Olivain <ju.o@free.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-16 21:14:50 +01:00
Bernd Kuhls
e974de86e2 package/python-zopfli: bump version to 0.4.1
https://github.com/fonttools/py-zopfli/releases/tag/v0.4.1

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-15 21:34:39 +01:00
Bernd Kuhls
84e7b632d9 package/python-zope-interface: bump version to 8.2
https://github.com/zopefoundation/zope.interface/blob/8.2/CHANGES.rst

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-15 21:34:39 +01:00
Bernd Kuhls
35cdefb97d package/python-yarl: bump version to 1.23.0
https://github.com/aio-libs/yarl/blob/v1.23.0/CHANGES.rst

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-15 21:34:39 +01:00
Bernd Kuhls
48c3146af2 package/python-yamllint: bump version to 1.38.0
https://github.com/adrienverge/yamllint/blob/v1.38.0/CHANGELOG.rst

Tarball hashes were computed by scanpypi.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-15 21:34:39 +01:00
Bernd Kuhls
351f4543cb package/python-xmltodict: bump version to 1.0.4
https://github.com/martinblech/xmltodict/blob/v1.0.4/CHANGELOG.md

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-15 21:34:39 +01:00
Bernd Kuhls
6ebadc0d94 package/python-whitenoise: bump version to 6.12.0
https://github.com/evansd/whitenoise/blob/6.12.0/docs/changelog.rst

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-15 21:34:39 +01:00
Bernd Kuhls
635c145c16 package/python-wheel: security bump version to 0.46.3
https://github.com/pypa/wheel/blob/0.46.3/docs/news.rst

Version 0.46.2 fixes CVE-2026-24049:
wheel Allows Arbitrary File Permission Modification via Path Traversal

Fixes:
https://www.cve.org/CVERecord?id=CVE-2026-24049

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: mark the commit as "security" and add info in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-15 21:34:39 +01:00
Bernd Kuhls
9e4e331d18 package/python-werkzeug: bump version to 3.1.6
https://github.com/pallets/werkzeug/blob/3.1.6/CHANGES.rst

Please note that the fixed CVEs CVE-2026-21860 & CVE-2026-27199 only
relate to Windows.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-15 21:34:39 +01:00
Bernd Kuhls
87ae658375 package/python-websockets: bump version to 16.0
https://github.com/python-websockets/websockets/blob/16.0/docs/project/changelog.rst

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-15 21:34:39 +01:00
Bernd Kuhls
29bc88d4fb package/python-weasyprint: security bump version to 68.1
https://github.com/Kozea/WeasyPrint/blob/v68.1/docs/changelog.rst

Version 68.0 fixes CVE-2025-68616.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-15 21:34:39 +01:00
Bernd Kuhls
3fb9b3b8f4 package/python-uvicorn: bump version to 0.41.0
https://github.com/Kludex/uvicorn/blob/0.41.0/docs/release-notes.md

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-15 21:34:39 +01:00
Bernd Kuhls
df796e693c package/python-urwid: bump version to 3.0.5
https://github.com/urwid/urwid/blob/3.0.5/docs/changelog.rst

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-15 21:34:39 +01:00
Bernd Kuhls
c479ac4601 package/python-ujson: bump version to 5.12.0
https://github.com/ultrajson/ultrajson/releases/tag/5.12.0

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-15 21:34:39 +01:00
Bernd Kuhls
d26060f110 package/python-types-setuptools: bump version to 82.0.0.20260210
https://github.com/typeshed-internal/stub_uploader/blob/main/data/changelogs/setuptools.md

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-15 21:34:39 +01:00