Skip to content

Conversation

@pull
Copy link

@pull pull bot commented Feb 2, 2026

See Commits and Changes for more details.


Created by pull[bot] (v2.0.0-alpha.4)

Can you help keep this open source service alive? 💖 Please sponsor : )

bkuhls and others added 15 commits February 2, 2026 09:10
https://gitlab.com/procps-ng/procps/-/blob/v4.0.6/NEWS

Removed patch which is included in this release.

Switched _SITE to https.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Brings additional optimizations and bugfixes:

Fix to heap buffer overflow in vp9_deblock, vp9_post_proc_frame, and
vp9_pack_bitstream.

Fix to integer overflow in vp9_highbd_post_proc, vp9_rc_regulate_q,
tiny_ssim, and vp9_calc_pframe_target_size_one_pass_cbr.

Fix to use-of-uninitialized-value in vp9_highbd_post_proc, mfqe, and
vp8_datarate_test.

Fix to out-of-bounds in log_tile_cols_from_picsize_level.
Fix to double free on initialization failure in vpx_codec_enc_init_multi.
Fix to division-by-zero crash in vpxenc with 0 FPS numerator input.
Fix to various build failures for Arm/SVE2, macOS cross-compilation, and
Xcode 16.

https://chromium.googlesource.com/webm/libvpx/+/refs/tags/v1.16.0

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
https://dev.gnupg.org/source/libgcrypt/browse/master/NEWS;libgcrypt-1.12.0
https://dev.gnupg.org/T7643

Updated license hash due to upstream commit
https://dev.gnupg.org/rC67b8da4ef62734927e061327efa9a6f48616d114

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
The definition of the project name & version is stored under the
`metadata:component` CycloneDX property.

Since the introduction of the `generate-cyclonedx` script [1] a
'buildroot' dependency entry that depends on every components has been
part of the generated SBOM.
Tools such as 'DependencyTrack' relies on such entry to create graph of
the entire project.

With the commit [2] that introduced the option to pass a custom project
name and version, this dependency reference was not updated to match the
custom 'bom-ref'.

This patch fixes the reference to match the custom project name.

[1] dbab39e support/scripts/generate-cyclonedx.py: add script to generate CycloneDX-style SBOM
[2] 9cbbc47 utils/generate-cyclonedx: add project name and version options

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Since the introduction of the `generate-cyclonedx` script in [1] the
dependencies were 'recursive'. This means that the dependencies of a
package dependency were included.

The CycloneDX spec [2] states that only direct dependencies needs to be
included.

This patch drop the recursive dependencies.

[1] dbab39e support/scripts/generate-cyclonedx.py: add script to generate CycloneDX-style SBOM
[2] https://cyclonedx.org/docs/1.6/json/#dependencies

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Add the list of virtual packages a show-info entry provides to the
output.

For more information on virtual packages infrastructure see [1]

[1] https://buildroot.org/downloads/manual/manual.html#_infrastructure_for_virtual_packages

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Since its introduction in [1], by default the `generate-cyclonedx`
script doesn't include buildroot's virtual packages in its 'components'
list, unless using the `--virtual` argument.

References to virtual packages present in the 'show-info' output are
filtered out in the resulting dependencies.

This patch fix the default CycloneDX dependencies generation
without virtual packages to reference the packages that provide the
virtual package instead of just dropping the virtual package itself.

If we use the package `lbase64` that depends on the virtual package
`luainterpreter` as an example. The 'dependency' entry looks like the
following:

```
{
  "ref": "lbase64",
  "dependsOn": [
    "host-skeleton",
    "skeleton-init-common",
    "skeleton-init-sysv",
    "toolchain-external-bootlin"
  ]
}
```

The `luainterpreter` dependency is missing.

After applying this patch, package that provides the `luainterpreter` is
present:

```
{
  "ref": "lbase64",
  "dependsOn": [
    "host-skeleton",
    "lua",
    "skeleton-custom",
    "skeleton-init-sysv"
  ]
}
```

In the case of a virtual package provided by multiple packages all those
packages will be listed. This happens when generating an SBOM on the
entire Buildroot packages.

[1] dbab39e support/scripts/generate-cyclonedx.py: add script to generate CycloneDX-style SBOM

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Buildroot commit bumped libressl from version 3.8.4 to 3.9.2.

Libressl 3.9.0 contains a breaking change:
https://github.com/libressl/portable/releases/tag/v3.9.0
"EVP_add_{cipher,digest}() were removed."

Upstream was notified by Yegor but did not add any fixes:
https://sourceforge.net/p/uftp-multicast/discussion/general/thread/c02c950dff/
so we force the usage of libopenssl to fix a build error:

encrypt_openssl.c: In function 'crypto_init':
encrypt_openssl.c:77:5: error: implicit declaration of function
 'EVP_add_cipher'; did you mean 'EVP_Cipher'?
 [-Wimplicit-function-declaration]
   77 |     EVP_add_cipher(EVP_aes_128_ccm());

first caught by the autobuilders on 2024-08-09:
https://autobuild.buildroot.net/results/7da/7dadc662e0a6642e40831a93b788e959498d8923/

Fixes:
https://autobuild.buildroot.net/results/a74/a74526181dfc90aff7f56457c430c1aa1d006e54/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Buildroot commit 99585db bumped the
package from version 9.21.4 to 9.33.0.

Upstream added std::atomic to drbdmon with commit
LINBIT/drbd-utils@3baf945
to version 9.25.0 causing build errors:

/home/autobuild/autobuild/instance-2/output-1/per-package/drbd-utils/host/bin/../lib/gcc/microblazeel-buildroot-linux-uclibc/14.3.0/../../../../microblazeel-buildroot-linux-uclibc/bin/ld:
 MessageLogNotification.o: in function `MessageLogNotification::query_log_changed()':
 (.text+0xe8): undefined reference to `__atomic_exchange_1'

Fixes:
https://autobuild.buildroot.net/results/741/741606000c26bc994f243b0b865d26ff25592caa/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
For change log since 20250807, see:
https://github.com/acpica/acpica/releases/tag/20251212

Upstream changed the source archive from a github user attachment
to a release asset. This commit updates ACPICA_SITE accordingly.

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
See release announce:
https://lists.ubuntu.com/archives/fwts-devel/2025-November/014113.html

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
For change log since 1.9.0, see:
https://codeberg.org/ivarch/pv/src/tag/v1.10.3/docs/NEWS.md

Upstream commit [1], included in version 1.9.42, introduced a use
of fork(). This commit adds this new dependency.

The pgp key ID used to sign the source archive changed. This commit
updates the comment in the hash file.

[1] https://codeberg.org/ivarch/pv/commit/fb7c05c2629cfa9770b44b7bf71e0faced60b55d

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
See release announce:
https://octave.org/news/release/2025/10/01/octave-10.3.0-released.html

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
LuaDist and their subprojects are dead

LuaDist was based on CMake, so back to luarocks infrastructure

different tag scheme, but same source (ie. lzlib.c)

this obviously fixes CMake 4 compatibility.

Fixes:

  https://autobuild.buildroot.net/results/c86c19a4b8fc4304244e33d4f132fea8e0043e06/

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
@pull pull bot locked and limited conversation to collaborators Feb 2, 2026
@pull pull bot added the ⤵️ pull label Feb 2, 2026
@pull pull bot merged commit b9a8f18 into mir-one:master Feb 2, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants