package/python-fonttools: bump version to 4.61.1

https://github.com/fonttools/fonttools/releases/tag/4.61.1

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/python-flask-jsonrpc: bump version to 4.0.0

https://github.com/cenobites/flask-jsonrpc/releases/tag/v4.0

Switched setup type to hatch and updated license file:
https://github.com/cenobites/flask-jsonrpc/commit/a4031daaaf54b67f002b62de162a904f3f34cee4

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/python-filelock: security bump version to 3.20.1

https://github.com/tox-dev/filelock/releases/tag/3.20.1

Fixes CVE-2025-68146: https://github.com/advisories/GHSA-w853-jp5j-5j7f

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/python-fastapi: bump version to 0.126.0

https://github.com/fastapi/fastapi/blob/0.126.0/docs/en/docs/release-notes.md

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/python-dtschema: bump version to 2025.12

https://github.com/devicetree-org/dt-schema/releases/tag/v2025.12

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/python-docutils: bump version to 0.22.4

https://docutils.sourceforge.io/HISTORY.html#release-0-22-4-2025-12-18

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/python-crontab: bump version to 3.3.0

https://gitlab.com/doctormo/python-crontab/-/tags/v3.3.0

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/python-cachetools: bump version to 6.2.4

https://github.com/tkem/cachetools/blob/v6.2.4/CHANGELOG.rst

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/python-colorlog: bump version to 6.10.1

https://github.com/borntyping/python-colorlog/releases/tag/v6.10.1

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/watchdogd: bump to version 4.1

Changes:
 - Add watchdogctl list-clients command to display currently subscribed
   clients to the process supervisor. Outputs to stdout in either table
   format (default) with colored headers, or JSON format with -j/--json
 - New global -j, --json option for machine-readable output, currently
   supported by list-clients and status commands
 - New API: wdog_clients() returns array of wdog_client_t structs for
   programmatic access to subscribed clients. See API documentation at
   https://codedocs.xyz/troglobit/watchdogd/wdog_8h.html
 - Enhance watchdogctl status command to display formatted output by
   default, with device information, capabilities, and reset history in
   a human-readable table format. Use -j/--json for JSON output

Fixes:
 - Generic scripts running more than 1 second would fail with false
   "critical error" reports and cause unwanted system reboots due
   to uninitialized exit status variable
 - watchdogctl reload with tempmon crashes watchdogd
 - Issue causing unwanted reboot when watchdogctl reload was called
   while a generic monitor script was running
 - Fix memory leak in generic monitor with optional script path, would
   be triggered on watchdogctl reload

The first of the fixes means we can now drop the backported patch.
Also, the test mode has been dropped from public use, hence it being
removed as well in this commit.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/libmbus: bump version to 0.9.0

Release notes:
https://github.com/rscada/libmbus/blob/0.9.0/release_notes.txt

Downloading the source tarball is broken since at least Oct 30th, 2024
as reported by the buildroot autobuilders:
https://autobuild.buildroot.net/?reason=libmbus-0.8.0&step=50&start=50

Switching to the github helper provides the correct source code but the
tarball downloaded has a different hash. A quick search did not provide
alternative download locations for the original tarball
libmbus-0.8.0.tar.gz.

To solve the broken build we do not only switch _SITE to github but also
bump the package to 0.9.0 and add autoreconf which needs two directories
being created in _POST_PATCH_HOOKS. One missing directory was already
reported upstream: https://github.com/rscada/libmbus/issues/179

Updated license hash due to upstream commit:
https://github.com/rscada/libmbus/commit/ab8919136d3cabb943b1cbdd4d6e2f7eea4b8f3f

Fixes:
https://autobuild.buildroot.net/results/91a/91a82dc73bf87cf1969cd6a2ddea1809ab9a1613/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: change release notes url to use tag]
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/ltp-testsuite: bump version to 20250930

Changelog:
https://github.com/linux-test-project/ltp/releases/tag/20250930

Remove patches backported from this release.

Remove LTP_TESTSUITE_AUTORECONF (patch, which required it was backported
from this release).

Require kernel headers for uclibc >= 4.5 for uclibc due F_GETOWN_EX from <fcntl.h>.

Signed-off-by: Petr Vorel <petr.vorel@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/v4l2loopback: bump version to 0.15.3

Changelog:
https://github.com/v4l2loopback/v4l2loopback/blob/v0.15.3/ChangeLog

This new version fixes compilation errors with gcc >= 14.

Fixes:
https://autobuild.buildroot.net/results/910/910e27b189c62f977bc42f7c53471334eb765168/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: add comment about the fixed issue]
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/udpcast: bump version to 20250223

Release notes of this bugfix release:
https://udpcast.linux.lu/mailman3/hyperkitty/list/udpcast@udpcast.linux.lu/thread/JTGZCUMSXYLVT73TIRJJICBX7AWIE4CA/

Switched _SITE and Config.in homepage URL to https.

Fixes:
https://autobuild.buildroot.net/results/acf/acf208588c2ca7e658a9a7bee49b947309d6b8be

Upstream removed the tarball of the previous version causing autobuilder
errors, first recorded March, 2nd 2025.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: update package homepage url to use https]
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/nushell: bump version to 0.108.0

Release notes: https://www.nushell.sh/blog/

Updated license hash due to copyright year bump:
https://github.com/nushell/nushell/commit/192ee59c754ec5c9b66e28cca94a75d643501be7

Fixes:
https://autobuild.buildroot.net/results/d27/d27004dd62cd0c87fbfbe0eca8057b17d84c799d/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/rtl8723bu: bump to 2025-12-14 version

This version allows to build with Linux 6.18

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/rtl8821cu: bump to version 2025-12-14

With this commit it builds with Linux 6.18

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/esp-hosted: bump to version 1.0.5.0.3

Drop local patch that has been upstreamed.

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/libselinux: host-python3 needs SSL support

Buildroot commit 285097051d4a7dd821f01d15c705867f7e26c635 bumped
python-pip to version 25.3, causing build errors when host-python3 was
built without SSL support:

  WARNING: pip is configured with locations that require TLS/SSL,
   however the ssl module in Python is not available.
[...]
  Could not fetch URL https://pypi.org/simple/setuptools/:
   There was a problem confirming the ssl certificate:
   HTTPSConnectionPool(host='pypi.org', port=443): Max retries exceeded
   with url: /simple/setuptools/ (Caused by SSLError("Can't connect to
   HTTPS URL because the SSL module is not available.")) - skipping
  ERROR: Could not find a version that satisfies the requirement setuptools>=40.8.0 (from versions: none)

Reverting the python-pip bump reveals the true cause of the build error
by showing these messages:

  WARNING: pip is configured with locations that require TLS/SSL,
   however the ssl module in Python is not available.
[...]
  DEPRECATION: Building 'selinux' using the legacy setup.py bdist_wheel
  mechanism, which will be removed in a future version. pip 25.3 will
  enforce this behaviour change. A possible replacement is to use the
  standardized build interface by setting the `--use-pep517` option,
  (possibly combined with `--no-build-isolation`), or adding a
  `pyproject.toml` file to the source tree of 'selinux'.
  Discussion can be found at https://github.com/pypa/pip/issues/6334

Selecting BR2_PACKAGE_HOST_PYTHON3_SSL fixes the problem.

Criu, the only other buildroot package using host-python-pip as
dependency, already selects BR2_PACKAGE_HOST_PYTHON3_SSL.

Fixes:
https://autobuild.buildroot.net/results/fd6/fd6d3edd5f74d094621ac9fdb93db24520b7a6e3/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/drbd-utils: bump version to 9.33.0

Changelog: https://github.com/LINBIT/drbd-utils/blob/v9.33.0/ChangeLog

This new version also fixes build failures with gcc >= 15.

Fixes:
https://autobuild.buildroot.net/results/abd/abd9fe3f8b8051b8fac278bcd56e1c11aa056737/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: add comment about gcc-15 build failure]
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/nanomsg: bump version to 1.2.2

Release notes:
https://github.com/nanomsg/nanomsg/releases/tag/1.2.1
https://github.com/nanomsg/nanomsg/releases/tag/1.2.2

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

support/testing: add tests for FIT hash support in package/uboot-tools

The tests check if all supported hash algorithms are usable in
mkimage, for both host and target packages. Additionally, as a
necessary tool, it verifies the previous fix for FIT output from
dumpimage.

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
[Julien: use builtin kernel for faster testing]
Signed-off-by: Julien Olivain <ju.o@free.fr>

support/testing: infra: add host bin dir to PATH when running host command

Some host commands need to call other host commands: For example,
"mkimage" from host-uboot-tools needs to run "dtc". This would fail or
call system commands without adding the host bin dir to PATH.

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
[Julien: use python functions/constants to build path]
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/uboot-tools: include FIT print support if FIT support is enabled

Otherwise "dumpimage -l" produces only a newline when processing a FIT
image.

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/python-glslang: bump version to 16.1.0

https://github.com/KhronosGroup/glslang/blob/16.1.0/CHANGES.md

Supports spirv-{headers, tools} version 1.4.335.0:
https://github.com/KhronosGroup/glslang/commit/209b675bf0c0d82c0e536bcb3cb7e1011957dd59

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/spirv-{headers, tools}: bump to version 1.4.335.0

https://github.com/KhronosGroup/SPIRV-Tools/blob/vulkan-sdk-1.4.335.0/CHANGES
https://github.com/KhronosGroup/SPIRV-Headers/releases/tag/vulkan-sdk-1.4.335.0

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/spirv-llvm-translator: bump version to 21.1.3

https://github.com/KhronosGroup/SPIRV-LLVM-Translator/releases/tag/v21.1.3

Switched version number format according to 'git describe'result:

$ git describe --tags --match 'v21*' --abbrev=40 llvm_release_210
v21.1.3

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/libconfig: bump to version 1.8.2

For change log, see:

https://github.com/hyperrealm/libconfig/releases/tag/v1.8.2

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Reviewed-by: Florian Larysch <fl@n621.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/python-sqlparse: bump to 0.5.4

Changes: https://sqlparse.readthedocs.io/en/latest/changes.html#release-0-5-4-nov-28-2025

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/python-anyio: bump to 4.12.0

Drop dependency on python-sniffio, that's no longer required.

Release Notes https://github.com/agronholm/anyio/releases/tag/4.12.0

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/python-pydantic: bump to 2.12.5

Release Notes: https://github.com/pydantic/pydantic-core/releases/tag/v2.41.5

No bump of pydantic-core as the version requirement didn't change.

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/libglib2: bump version to 2.86.2

Release Notes: https://gitlab.gnome.org/GNOME/glib/-/releases/2.86.2

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Tested-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>

configs/acmesystems_acqua_a5_*: bump to Linux 6.18.1

Also update the device tree: since Linux v6.15-rc1 (510a6190cf5e "ARM:
dts: microchip: fix faulty ohci/ehci node names"), the USB nodes are
named "usb" instead of "ohci" or "ehci".

Signed-off-by: Edgar Bonet <bonet@grenoble.cnrs.fr>
[Julien: update linux.hash comment to take hash from upstream]
Signed-off-by: Julien Olivain <ju.o@free.fr>

configs/acmesystems_acqua_a5_*: switch to Bootlin glibc stable toolchain

Update the Acmesystem's Acqua defconfigs to the Bootlin glibc stable
external toolchain, as per[1].

[1]: https://elinux.org/Buildroot:DeveloperDaysELCE2024#Rules_for_defconfigs

Signed-off-by: Edgar Bonet <bonet@grenoble.cnrs.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/gkrellm: bump version to 2.5.0

https://git.srcbox.net/gkrellm/gkrellm/src/tag/gkrellm-2.5.0/CHANGELOG.md

Added sha256 hash provided by upstream.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/libinput: bump version to 1.30.1

https://lore.freedesktop.org/wayland-devel/20251125050917.GA854973@quokka/T/#u
https://lore.freedesktop.org/wayland-devel/20251208024732.GA3642318@quokka/T/#u

Added optional dependency to lua-5.4:
https://gitlab.freedesktop.org/libinput/libinput/-/commit/9461d1a9a17337c6ee5a4baee836fb9b9e12906c

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/inadyn: bump to v2.13.0

Changes:
 - Add support for Porkbun DDNS provider
 - Add support for domene.shop (Norwegian DDNS provider)
 - Add support for round-robin records to Cloudflare
 - Add example config for DuckDNS IPv6
 - Cloudflare: omit proxy setting if unset in config
 - Cloudflare: omit TTL update if unset in config
 - Simply.com provider fixed and re-enabled
 - Support for long ddns-path requests (increased buffer size)

Fixes:
 - Do not use an IP resolution method different than the one
   specified in configuration
 - Fix support for Namecheap
 - Fix Dynu IPv6 issue
 - Default value -1 not used for ttl setting
 - Fix IPv6 detection for providers with "v6" in their name,
   e.g., ipv64.net and dynv6.com
 - Fix dnspod error: "Communication with checkip server failed"
 - Fix cache directory creation on --help or --check-config
 - Fix cache directory not writeable and no $HOME

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/mesa3d: add missing dependencies for imagination driver

The build of the following basic configuration enabling the
imagination Vulkan driver

BR2_aarch64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_AARCH64_GLIBC_STABLE=y
BR2_PACKAGE_MESA3D=y
BR2_PACKAGE_MESA3D_VULKAN_DRIVER_IMAGINATION=y

fails with:

meson.build:847:3: ERROR: Feature llvm cannot be disabled: CLC requires LLVM

Adding just LLVM as a dependency is not enough, as then libclc is
needed, then LLVMSPIRVLib, then clangBasic, then the pco_clc tool.

In fact, like the Panfrost driver, building the Imagination driver
requires building host tools using host-mesa3d. To fix this we:

- Make the BR2_PACKAGE_MESA3D_OPENCL option selectable

- Make sure that BR2_PACKAGE_MESA3D_VULKAN_DRIVER_IMAGINATION depends
  on BR2_PACKAGE_MESA3D_LLVM and select
  BR2_PACKAGE_MESA3D_NEEDS_PRECOMP_COMPILER (the latter being needed to
  build host-mesa3d)

- Make sure the host-mesa3d builds imagination
  tools (-Dtools=imagination) and install
  pco_clc (HOST_MESA3D_INSTALL_PCO_CLC). This requires introducing
  HOST_MESA3D_TOOLS as a list of tools to build, which then gets used
  to construct the -Dtools argument, as we can now have both
  "panfrost" and "imagination" in this list.

With all this, the defconfig above builds successfully.

This has been broken since Buildroot commit
5e818c16a31a902ec29a250f920f43c76e2d9868, which introduced the vulkan
driver support.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/mesa3d: fix imagination Vulkan driver build

Since upstream commit 6e189ba6c17a2ab9b60e6fd65fc6a44a17dc9e8f, merged
in mesa-25.3.0, the imagination Vulkan driver is no longer
experimental.

Therefore, since Buildroot commit
3e296a151195f9d32dbfd62d6c75d08b822be6dd, which bumped mesa3d to
version 25.3.0, the build of a configuration such as:

 BR2_aarch64=y
 BR2_TOOLCHAIN_EXTERNAL=y
 BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
 BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_AARCH64_GLIBC_STABLE=y
 BR2_PACKAGE_MESA3D=y
 BR2_PACKAGE_MESA3D_VULKAN_DRIVER_IMAGINATION=y

fails with:

build/mesa3d-25.3.1/meson.build:4:0: ERROR: Value "imagination-experimental" for option "vulkan-drivers" is not in allowed choices: "auto, amd, broadcom, freedreno, intel, intel_hasvk, panfrost, swrast, virtio, imagination, microsoft-experimental, nouveau, asahi, gfxstream, all"

Fix this by using the proper Vulkan driver name.

There are no autobuilder failures for this issue.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/{mesa3d, mesa3d-headers}: bump version to 25.3.2

https://lists.freedesktop.org/archives/mesa-announce/2025-December/000831.html

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/llvm-project: bump to version 21.1.8

Release notes:
https://discourse.llvm.org/t/llvm-21-1-8-released/89144

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/kodi-inputstream-adaptive: bump version to 21.5.18-Omega

Release notes of this bugfix release:
https://github.com/xbmc/inputstream.adaptive/releases/tag/21.5.18-Omega

Removed patch 0001 which is included in this release:
https://github.com/xbmc/inputstream.adaptive/commit/a224dc66e93aa0d79152ef283cc7dd2207f7cf7d

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/kodi-pvr-mythtv: bump version to 21.2.2-Omega

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/cryptsetup: bump version to 2.8.3

For release note, see:
https://gitlab.com/cryptsetup/cryptsetup/-/blob/v2.8.3/docs/v2.8.3-ReleaseNotes

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/linenoise: security bump to version e26268de5e

Fixes:
CVE-2025-9810: TOCTOU in linenoiseHistorySave
https://www.cve.org/CVERecord?id=CVE-2025-9810

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/python-*: mass update of hash comments computed by scanpypi

No changes to hashes, only comments in hash files computed by our
utils/scanpypi script are updated by this patch.

During future mass package updates this patch will reduce the number of
changes created by scanpypi to be reviewed.

Please note that an updated version of scanpypi was used:
https://patchwork.ozlabs.org/project/buildroot/patch/20251001002004.3178942-1-james.hilliard1@gmail.com/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Peter: drop packages not downloaded from pypi or where rust vendoring is
        used]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/libgpg-error: bump version to 1.58

https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgpg-error.git;a=blob;f=NEWS;h=c60ad85d84da2a1721e6bb8c4ae95e645be1b201;hb=e880193c55f0321bbefc16be3194fdbb7a48078f

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/libldns: bump to version 1.9.0

Changelog: https://github.com/NLnetLabs/ldns/blob/1.9.0/Changelog

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/redis: bump to v8.4.0

See the release notes: https://github.com/redis/redis/blob/8.4.0/00-RELEASENOTES

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/cryptsetup: bump version to 2.8.2

For release note, see:
https://gitlab.com/cryptsetup/cryptsetup/-/blob/v2.8.2/docs/v2.8.2-ReleaseNotes

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/zfs: bump version to 2.4.0

Removed backported patch:
 - 0001-use-sys_stath-instead-of-linux_stath.patch
Merged upstream in:
https://github.com/openzfs/zfs/commit/ccf5a8a6fcfdfbdaa2f0fdca5d787958224bf06d

For release note, see:
https://github.com/openzfs/zfs/releases/tag/zfs-2.4.0

Signed-off-by: José Luis Salvador Rufo <salvador.joseluis@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/libfuse3: bump to version 3.18.0

Release notes:
https://github.com/libfuse/libfuse/releases/tag/fuse-3.18.0

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/php: security bump version to 8.4.16

https://www.php.net/ChangeLog-8.php#8.4.16
https://news-web.php.net/php.announce/478

Fixes CVE-2025-14177, CVE-2025-14178, CVE-2025-14180 & CVE-2025-67899.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/python-gpiod: fix md5 hash

Buildroot commit b243b77ebe5eedf8fbc683d5539d9bf386da4420 added this
package including a hash file containing a typo of the tarball filename
for the md5 hash. Updated comment as computed by scanpypi.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/perl: bump to version 5.42.0

For release notes, see:
https://perldoc.perl.org/5.42.0/perl5420delta

Note: the release notes mention fixed CVE. Those were already fixed in
Buildroot commit [1] and [2]. Therefore, this update is not marked as a
security fix.

This commit also updates the `utils/scancpan` script, in order to
update the messages about the host-perl version.

[1] https://gitlab.com/buildroot.org/buildroot/-/commit/61f5e2efcae5ece840a561ad56cdec04dad3a25d
[2] https://gitlab.com/buildroot.org/buildroot/-/commit/164c84ee9b820f5b21e79b4d52c07a613925d3f2

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
[Julien: add commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/dmidecode: bump to version 3.7

Release notes:
https://lists.nongnu.org/archive/html/dmidecode-devel/2025-12/msg00039.html

Signed-off-by: Pierre-Yves Kerbrat <pkerbrat@free.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/linux-headers: drop 6.17.x option

The 6.17.x series is now EOL upstream, so drop the linux-headers
option and add legacy handling for it.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

{linux, linux-headers}: bump 6.{12, 17, 18}.x series

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/json-c: fix build with CMake 4

The build of host-json-c currently fails due to the move to CMake
4. However, we don't need to patch the problem, as we can instead
disable building the json-c applications (-DBUILD_APPS=OFF) for the
host variant like we already do for the target variant.

Fixes:

  https://autobuild.buildroot.net/results/dcf72922750a830901279e8eb8fc2def95d35e01/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/python-magic-wormhole: bump version to 0.21.1

For change log since 0.19.2, see:
https://github.com/magic-wormhole/magic-wormhole/blob/0.21.1/NEWS.md

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: add link to change log]
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/python-zopfli: bump version to 0.4.0

https://github.com/fonttools/py-zopfli/releases

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/python-zope-interface: bump version to 8.1.1

https://github.com/zopefoundation/zope.interface/blob/8.1.1/CHANGES.rst

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/python-zeroconf: bump version to 0.148.0

https://github.com/python-zeroconf/python-zeroconf/releases/tag/0.148.0
https://github.com/python-zeroconf/python-zeroconf/blob/0.148.0/CHANGELOG.md

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/python-yarl: bump version to 1.22.0

https://github.com/aio-libs/yarl/blob/v1.22.0/CHANGES.rst

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/python-wsproto: bump version to 1.3.2

https://github.com/python-hyper/wsproto/blob/1.3.2/CHANGELOG.rst

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/python-werkzeug: bump version to 3.1.4

https://github.com/pallets/werkzeug/blob/3.1.4/CHANGES.rst

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/python-webargs: bump version to 8.7.1

https://github.com/marshmallow-code/webargs/blob/8.7.1/CHANGELOG.rst

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/python-weasyprint: bump version to 67.0

https://github.com/Kozea/WeasyPrint/blob/v67.0/docs/changelog.rst

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/python-urwid: bump version to 3.0.4

https://github.com/urwid/urwid/blob/3.0.4/docs/changelog.rst

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/python-ujson: bump version to 5.11.0

https://github.com/ultrajson/ultrajson/releases/tag/5.11.0

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/python-types-setuptools: bump version to 80.9.0.20250822

https://github.com/typeshed-internal/stub_uploader/blob/main/data/changelogs/setuptools.md

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/python-types-python-dateutil: bump version to 2.9.0.20251115

https://github.com/typeshed-internal/stub_uploader/blob/main/data/changelogs/python-dateutil.md

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/python-types-psutil: bump version to 7.1.3.20251211

https://github.com/typeshed-internal/stub_uploader/blob/main/data/changelogs/psutil.md

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/python-typeguard: bump version to 4.4.4

https://github.com/agronholm/typeguard/blob/4.4.4/docs/versionhistory.rst

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/python-twisted: bump version to 25.5.0

https://github.com/twisted/twisted/blob/twisted-25.5.0/NEWS.rst

Updated license hash due to copyright year bump:
https://github.com/twisted/twisted/commit/662f2a9b0563cd7a0f6acf0ed92891ae2cd7e1f3

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/python-trove-classifiers: bump version to 2025.12.1.14

https://github.com/pypa/trove-classifiers/releases

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/python-trio: bump version to 0.32.0

https://github.com/python-trio/trio/blob/v0.32.0/docs/source/history.rst

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/python-treq: bump version to 25.5.0

https://github.com/twisted/treq/blob/treq-25.5.0/CHANGELOG.rst

Switched build system to hatch:
https://github.com/twisted/treq/commit/88ba8110f82cc721c37da1ce96fbaa83a0e6807b

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/python-tomlkit: bump version to 0.13.3

https://github.com/python-poetry/tomlkit/blob/0.13.3/CHANGELOG.md

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/python-tomli: bump version to 2.3.0

https://github.com/hukkin/tomli/blob/2.3.0/CHANGELOG.md

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/python-tinycss2: bump version to 1.5.1

https://github.com/Kozea/tinycss2/blob/v1.5.1/docs/changelog.rst

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/python-termcolor: bump version to 3.2.0

https://github.com/termcolor/termcolor/releases

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/python-soupsieve: bump version to 2.8

https://github.com/facelessuser/soupsieve/blob/2.8/docs/src/markdown/about/changelog.md

Updated license hash due to copyright year bump:
https://github.com/facelessuser/soupsieve/commit/a616022df73ddc5ecb71092155be9baba876b52d

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/python-sh: bump version to 2.2.2

https://github.com/amoffat/sh/blob/2.2.2/CHANGELOG.md

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/python-setuptools-scm: bump version to 9.2.2

https://github.com/pypa/setuptools-scm/blob/v9.2.2/CHANGELOG.md

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/python-setuptools-rust: bump version to 1.12.0

https://github.com/PyO3/setuptools-rust/blob/v1.12.0/CHANGELOG.md

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/python-fastapi: bump to 0.124.4

Two more bugfix releases:

* https://github.com/fastapi/fastapi/releases/tag/0.124.3
* https://github.com/fastapi/fastapi/releases/tag/0.124.4

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/python-jeepney: bump version to 0.9.0

https://gitlab.com/takluyver/jeepney/-/blob/0.9/docs/release-notes.rst

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/python-aiosqlite: bump version to 0.22.0

https://github.com/omnilib/aiosqlite/blob/v0.22.0/CHANGELOG.md

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/python-aiodns: bump version to 3.6.1

https://github.com/aio-libs/aiodns/releases/tag/v3.6.1

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/vim: bump package to version 9.1.1989

Changelog:
https://github.com/vim/vim/compare/v9.1.1684...v9.1.1989

Signed-off-by: Pierre-Yves Kerbrat <pkerbrat@free.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/sway: properly propagate wlroots dependencies

Commit 00fb3a57cbaedb8df43f75f0e891423c1ef7d8c6 added a wlroots ->
libgbm dependency, but forgot to propagate it to package/sway.

Cc: Raphael Pavlidis <raphael.pavlidis@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Reviewed-by: Adrian Perez de Castro <aperez@igalia.com>
Reviewed-by: Raphael Pavlidis <raphael.pavlidis@gmail.com>
Tested-by: Raphael Pavlidis <raphael.pavlidis@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/cage: properly propagate wlroots dependencies

Commit 00fb3a57cbaedb8df43f75f0e891423c1ef7d8c6 added a wlroots ->
libgbm dependency, but forgot to propagate it to package/cage.

Fixes:

  https://autobuild.buildroot.net/results/dc185c3d4886e9cfd9e6f46b50b864e5b2f28605/

Cc: Raphael Pavlidis <raphael.pavlidis@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Reviewed-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/exim: security bump version to 4.99.1

Release notes:
https://lists.exim.org/lurker/message/20251217.151548.85d1a2bc.en.html

Fixes CVE-2025-67896:
https://code.exim.org/exim/exim/src/branch/exim-4.99+fixes/doc/doc-txt/exim-security-2025-12-09.1/report.txt

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/libfcgi: security bump to 2.4.7

This is a security bump to fix CVE-2025-23016.

See:
https://github.com/FastCGI-Archives/fcgi2/releases/tag/2.4.7

Signed-off-by: Thomas Devoogdt <thomas.devoogdt@barco.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/cmocka: disable documentation building

cmocka tries to find the Doxygen binary by default and if successful,
it tries to download style sheets and breaks with the following message:

CMake Error at
doxygen-awesome-css-subbuild/doxygen-awesome-css-populate-prefix/src/doxygen-awesome-css-populate-stamp/download-doxygen-awesome-css-populate.cmake:163
(message):
  Each download failed!

    error: downloading
'https://github.com/jothepro/doxygen-awesome-css/archive/refs/tags/v2.4.1.tar.gz'
failed
          status_code: 1
          status_string: "Unsupported protocol"
          log:
          --- LOG BEGIN ---
          Protocol "https" not supported

closing connection #-1

Disable the Doxygen package search entirely.

Fixes:
https://autobuild.buildroot.org/results/e6a04cee8bc3028bd8a1a535c2852e60f362c4ba/

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/zic: bump to 2025c

Release notes:
https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/TAGXKYLMAQRZRFTERQ33CEKOW7KRJVAK/

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/tzdata: bump to 2025c

Release Notes:
https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/TAGXKYLMAQRZRFTERQ33CEKOW7KRJVAK/

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/dropbear: security bump to version 2025.89

Fixes CVE-2025-14282
https://security-tracker.debian.org/tracker/CVE-2025-14282
CVE-2019-6111 for scp
https://security-tracker.debian.org/tracker/CVE-2019-6111

Release notes:
https://github.com/mkj/dropbear/releases/tag/DROPBEAR_2025.89

Signed-off-by: Matt Johnston <matt@codeconstruct.com.au>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/kvmtool: bump to current HEAD

By doing so we can also drop the patches for musl which have now been
merged upstream.

Reviewed-by: Jesse Taube <jesse@rivosinc.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>