Adolf Belka [Wed, 1 Jul 2026 11:34:43 +0000 (13:34 +0200)]
netsnmpd: Update to version 5.9.5.2
- Update from version 5.9.3 to 5.9.5.2
- Update of rootfile
- Move the symlink generation and removal from the lfs to the instal/uninstall pak
file to be aligned with the majority of packages.
- Version 5.9.4 has the note
IMPORTANT: SNMP over TLS and/or DTLS are not functioning properly
in this release with various versions of OpenSSL and will be fixed
in a future release.
- This issue has been in place since Aug 2023 and does not look to have been fixed as
far as I have been able to tell. The developers also say that this tool should only
be used on trusted local networks anyway. Additionally version 5.9.5 has a CVE fix.
Based on this I am submitting the update patch for review and decision. I think it is
better to do the update because it does not look like the OpenSSL issue will be
fixed anytime soon. It doesn't appear that anyone is working on it.
https://github.com/net-snmp/net-snmp/issues/828
- Changelog
5.9.5.2
building:
- Fix an issue with needing limits.h included.
- update to autoconf 2.72
5.9.5.1
Only a version numbering fix.
5.9.5
snmptrapd:
- fixed a critical vulnerability (CVE-2025-68615) which can be triggered
by a specially crafted trap
snmplib:
- Add support for IPV6_RECVPKTINFO
- Port the SSH domain transport to FreeBSD
- Improve error handling in parse_enumlist and other parsing functions
- Filter out non-ASCII characters from output
- Fix multiple memory leaks in MIB parsing, OID handling, and transport filters
- Fix multiple buffer overflows triggered when creating ASN packets
- Fix handling of large/negative values (integer underflows/overflows)
- Fix segmentation faults when `varbind` cannot be constructed or buf is null
- Fix crash in netsnmp_parse_args when passing invalid argument lists
- Fix SNMPv3 multithreading support for snmp_sess_open()
snmpd:
- Make UCD-SNMP::dskTable dynamic if includeAllDisks is set.") added
a verification that drops all filesystems not present in other_fs[]
table. So add 'ubifs' in other_fs[] to fix it.
- Fix SIGHUP handling for engineID changes and agent port changes
- Fix a use-after-free in unregister_mib_context()
- Fix regression of memory leak when using RPMDB macros
- Improve cache management: clear timer_id on stop, keep cache flags unchanged
- Always open libkvm in "safe mode" on FreeBSD
- Fix crash when snmptrapd subagent terminates the TCP connection
apps:
- snmpusm: Improve error handling and fix memory leaks
- sshtosnmp: Avoid EINVAL when passing credentials over SSH unix domain socket
- snmptest: Plug a possible memory leak
- snmpget: Avoid leak if parsing OID fails
MIBs:
- EtherLike-MIB: Optimize Linux implementation to use netlink statistics
- IP-MIB: Add Linux 6.7 compatibility for parsing /proc/net/snmp
- LM-SENSORS-MIB: Support negative temperatures
- SNMP-TLS-TM-MIB: Update to RFC 9456 and allow TLS protocols higher than TLS1.0
- HOST-RESOURCES-MIB: Add support for RPM SQLite DB background
building:
- Add support for Windows on ARM
- Support OpenBSD 8, FreeBSD 15/16, and DragonflyBSD
- Fix build for OS/X versions prior to 10.6.0
- Windows: Bump OpenSSL version and fix library paths
- MinGW64: Switch from pkg-config to pkgconf
- Add --with-wolfssl Add support for building and linking with the
wolfSSL library instead of OpenSSL. Other changes that have been
included in this patch are: - Only enable AES support if
EVP_aes_128_cfb() is available. - Add support for detecting SSL
functions if these have been defined as macros.
5.9.4
IMPORTANT: SNMP over TLS and/or DTLS are not functioning properly
in this release with various versions of OpenSSL and will be fixed
in a future release.
libsnmp:
- Remove the SNMP_SWIPE_MEM() macro Remove this macro since it is not
used in the Net-SNMP code base.
- DISPLAY-HINT fixes
- Miscellanious improvements to the transports
- Handle multiple oldEngineID configuration lines
- fixes for DNS names longer than 63 characters
agent:
- Added a ignoremount configuration option for the HOST-MIB
- disallow SETs with a NULL varbind
- fix the --enable-minimalist build
apps:
- snmpset: allow SET with NULL varbind for testing
- snmptrapd: improved MySQL logging code
general:
- configure: Remove -Wno-deprecated as it is no longer needed
- miscellanious ther bug fixes, build fixes and cleanups
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Wed, 1 Jul 2026 11:34:42 +0000 (13:34 +0200)]
ltrace: Update to version 0.8.1
- Update from version 0.7.3 to 0.8.1
- Update of rootfile
- ltrace now supports aarch64 (full support) and riscv64 (initial support) since
version 0.8.0
- Changelog
0.8.1
Bugfixes
- include config.h in more cases to fix LTO builds
0.8.0
Prototype libraries
- Each DSO can now ship an ltrace config file (called prototype
library) that ltrace will open when that DSO is loaded to process
image. See ltrace(1) for details.
- ltrace.conf is no longer part of installation tarball. Instead,
we now ship libc.so.conf, libm.so.conf, libacl.so.conf, and
syscalls.conf. Those are now istalled to /usr/share/ltrace by
default. /etc/ltrace.conf and $HOME/.ltrace.conf are still
loaded if present, and can contain arbitrary user configuration.
- The option -F was retrofitted to be a colon-separated list of
prototype libraries, and directories to look for prototype
libraries in. On Linux, ltrace looks into XDG_CONFIG_HOME,
XDG_CONFIG_DIRS, and /usr/share/ltrace as well.
- Wide character strings are supported in prototypes. Use "string"
lens as usual, but use array of integers as underlying type.
libc.so.conf now contains prototypes of wide character functions.
- Sole void function parameter such as in the following example, is
now considered obsolete:
| int fork(void); |
This use is still accepted, taken to mean "hide(int)", but
produces a warning, and will be removed in future.
- Prototypes are now read from DWARF debug info, if available. This
complements the data available in config files
Architectural support
- RISC-V initial support included.
- MIPS and MIPSel are now handled by the same backend.
- ARMv6, ARMv7 and ARMv8 (AArch64) are supported, including full
fetch backend. ARMv8 backend doesn't support tracing of 32-bit
binaries, as currently there's no 32-bit userspace available for
ARM64 processors.
- Imagination Technologies Meta is now supported.
- PowerPC64 ELFv2 little-endian ABI is now supported including full
fetch backend.
- Cadence Tensilica Xtensa is now supported.
- LoongArch is now supported.
- On Linux, tracing of IFUNC symbols is supported. On i386,
x86_64, ppc32 with secure PLT and ppc64, IRELATIVE PLT slots are
traced as well.
-w output now shows full library path
The output format is similar to glibc's backtrace_symbols, e.g.:
> /bin/ls(_init+0x19be) [0x40398e]
> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xed) [0x7f50cbc3676d]
> /bin/ls(_init+0x25fd) [0x4045cd]
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Wed, 1 Jul 2026 11:34:41 +0000 (13:34 +0200)]
lsof: Update to version 4.99.7
- Update from version 4.99.5 to 4.99.7
- No change to rootfile
- Changelog
4.99.7
lsof_free_result(): handle result == NULL by @neek78 (#349)
[linux] Fix missing parenthesis in lstat error message format by
@cuiweixie (#350)
Fix use-after-free in lsof_select_process_regex by @cuiweixie (#351)
Fix truncated fd numbers in -F field output by @kurok (#352)
Add -J/-j options for JSON and JSON Lines output format. -J outputs a
JSON envelope with process and file information; -j outputs JSON Lines
format where each line is a JSON object representing a file descriptor.
by @kurok (#353)
Document non-UTF-8 encoding behavior in JSON output by @kurok (#355)
Follow autoconf conventions for --enable/--disable help output
by @kurok (#356)
Skip building liblsof when --disable-liblsof is given by @kurok (#357)
[linux] Display connection state for UDP sockets with -T option by
@kurok (#358)
Add more information to the tutorial about debugging busy
mounts by @jakobcornell (#360)
Fix case sensitivity in INSTALL commands by @AngelofVerdant (#361)
[netbsd] Fix support for NetBSD 10/11 by @jiegec (#363)
4.99.6
[darwin] parse and print NETPOLICY FDTYPE properly by @neek78 (#347)
[linux] Treat NFS ESTALE fds as unlinked for +L selection by @x-lugoo
(#345)
[solaris] Update dlsof.h for Solaris NFS rnode4.h issues by
@nic-kulowiec (#342)
[doc] fix minor doc errors in 00README by @nic-kulowiec (#340)
[aix] Add AIX platform-specific process_file() with filename capture by
@uptycs-rmack (#339)
[aix] Fix AIX dialect to work with context refactor by @uptycs-rmack
(#338)
[freebsd] Update supported FreeBSD versions by @yasuhirokimura (#337)
Fix null pointer exception by @admardare-cyber (#336)
[freebsd] Fix freebsd 15 compat due to rpc and sysctl changes in kernel
headers
[darwin] File name is now properly saved in liblsof (#348)
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Tue, 30 Jun 2026 11:15:22 +0000 (13:15 +0200)]
stunnel: Update to version 5.78
- Update from version 5.72 to 5.78
- No change to rootfile
- Changelog
5.78
* Security bugfixes
- OpenSSL DLLs updated to version 3.5.6.
* Bugfixes
- Fixed WIN32 transfer() loop errors with OOB TCP.
- Fixed a memory leak introduced in version 5.73.
- Build fix for systems without timegm()
(thanks to Jose A. Diaz and Shubham Gupta).
- Fixed a startup crash when both global (default)
and service-level lists of values are configured
for an option.
* Features
- Support for zstd and brotli compression with OpenSSL 3.2
and TLS 1.2 or older.
- WIN32 OpenSSL build with zlib and zstd support.
- Support for new "options" parameter values.
- Less bloated errors on an invalid configuration file.
- Documentation updated from Pod to Pandoc Markdown.
- Removed support for OpenSSL versions older than 0.9.8.
The final update for the OpenSSL 0.9.7 branch
(0.9.7m) was issed on 23 Feb 2007.
5.77
* Security bugfixes
- OpenSSL DLLs updated to version 3.5.5.
* Bugfixes
- Avoid attempting to fetch OCSP stapling for PSK-only
configuration sections.
* Features
- Merged applicable patches from Fedora and Debian:
- Use SOURCE_DATE_EPOCH for reproducible builds.
- Skip the OpenSSL version check when AUTOPKGTEST_TMP is set.
- Enable PrivateTmp in the stunnel.service template.
- Clarify the manual page for the "curves" option.
- Log client IP addresses on TLS errors.
5.76
* Security bugfixes
- OpenSSL DLLs updated to version 3.5.4.
- Service-level multivalued options now override (rather than
append to) global defaults, preventing unintended configurations.
* Bugfixes
- Fixed enabling/disabling of the default fips=yes property.
- Missing OCSP stapling is no longer logged as an error.
- Fixed a crash when a PIN was required due to the PKCS#11
CKA_ALWAYS_AUTHENTICATE attribute.
* Features
- Quantum-resistant hybrid key agreement X25519+ML-KEM-768
(X25519MLKEM768) used by default with OpenSSL 3.5+ and TLS 1.3.
- Multiple cert sources are supported, allowing a certificate to
be fetched from a provider while loading the chain from a file.
- Android build switched to a 16 KB page size.
5.75
* Security bugfixes
- OpenSSL DLLs updated to version 3.4.1.
- OpenSSL FIPS Provider updated to version 3.1.2.
* Bugfixes
- Fixed infinite loop triggered by OCSP URL parsing errors
(thanks to Richard Könning for reporting).
- Fixed OPENSSL_NO_OCSP build issues
(thanks to Dmitry Mostovoy for reporting).
- Fixed default curve selection in FIPS mode with OpenSSL 3.4+.
- Fixed tests with modern Python versions.
- Fixed tests with multiple OpenSSL versions installed.
* Features
- Added provider URI support for "cert" and "key" options.
- Added new "CAstore" service-level option (OpenSSL 3.0+).
- Added "provider" (OpenSSL 3.0+), "providerParameter"
(OpenSSL 3.5+), and "setEnv" global options.
- Key file/URI path added to passphrase prompt on Unix.
- PKCS#11 provider installed on Windows.
5.74
* Bugfixes
- Fixed a stapling cache deallocation crash.
- Fixed "redirect" with protocol negotiation.
* Features
- "protocolHost" support for "socks" protocol clients.
- More detailed logs in OpenSSL 3.0 or later.
5.73
* Security bugfixes
- OpenSSL DLLs updated to version 3.3.2.
- OpenSSL FIPS Provider updated to version 3.0.9.
* Bugfixes
- Fixed a memory leak while reloading stunnel.conf
sections with "client=yes" and "delay=no".
- Fixed TIMEOUTocsp with values greater than 4.
- Fix the IPv6 test on a non-IPv6 machine.
* Features
- HELO replaced with EHLO in the post-STARTTLS SMTP
protocol negotiation (thanks to Peter Pentchev).
- OCSP stapling fetches moved away from server threads.
- Improved client-side session resumption.
- Added support for the mimalloc allocator.
- Check for protocolHost moved to configuration file
processing for the client-side CONNECT protocol.
- Clarified some confusing OpenSSL's certificate
verification error messages.
- stunnel.nsi updated for Debian 13 and Fedora.
- Improved NetBSD compatibility.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Tue, 30 Jun 2026 11:15:21 +0000 (13:15 +0200)]
strace: Update to version 7.1
- Update from version 6.18 to 7.1
- No change to rootfile
- Changelog
7.1
* Improvements
* Implemented wall-clock-aware columns (wall-total, wall-min, wall-max,
wall-avg) for the -c/--summary-only report, allowing wall-clock and
system CPU times to be displayed side by side in a single run.
* Included out-of-range syscalls in the -c/--summary-only report.
* Updated decoding of sched_getattr syscall.
* Implemented decoding of FS_IOC_SHUTDOWN, PIDFD_GET_INFO, and
PIDFD_GET_*_NAMESPACE ioctl commands.
* Implemented decoding of IFLA_BR_FDB_N_LEARNED, IFLA_BR_FDB_MAX_LEARNED,
and IFLA_BR_STP_MODE netlink attributes.
* Updated lists of CLONE_*, FSMOUNT_*, KT_*, KVM_*, LANDLOCK_*, NETDEV_*,
NL80211_*, and PIDFD_* constants.
* Updated lists of ioctl commands from Linux 7.1.
7.0
* Improvements
* Implemented optional colorized trace output.
* Implemented decoding of rseq and rseq_slice_yield syscalls.
* Implemented decoding of BPF_TRACE_FSESSION bpf attach type.
* Implemented decoding of BPF_PROG_ASSOC_STRUCT_OPS bpf command.
* Implemented decoding of UDMABUF_CREATE, UDMABUF_CREATE_LIST,
and VIDIOC_QUERYMENU ioctl commands.
* Updated decoding of statmount syscall flags.
* Updated lists of BPF_*, BTRFS_*, FS_*, IORING_*, KEY_*, KVM_*, NT_*,
OPEN_TREE_*, PR_*, V4L2_*, and *_MAGIC constants.
* Updated lists of ioctl commands from Linux 7.0.
6.19
* Improvements
* Implemented decoding of listns syscall.
* Implemented decoding of F_GET_RW_HINT, F_SET_RW_HINT, F_GET_FILE_RW_HINT,
F_SET_FILE_RW_HINT, F_GETDELEG, and F_SETDELEG fcntl commands.
* Implemented decoding of IORING_REGISTER_SEND_MSG_RING,
IORING_REGISTER_ZCRX_IFQ, IORING_REGISTER_RESIZE_RINGS,
IORING_REGISTER_MEM_REGION, IORING_REGISTER_QUERY, and
IORING_REGISTER_ZCRX_CTRL opcodes of io_uring_register syscall.
* Implemented decoding of extended argument structures for io_uring_enter
syscall when IORING_ENTER_EXT_ARG or IORING_ENTER_EXT_ARG_REG flags are set.
* Implemented decoding of attr_ptr and attr_type_mask fields of
struct io_uring_sqe for io_uring_register syscall.
* Implemented opcode-specific decoding of flags union and ioprio fields
of struct io_uring_sqe for io_uring_register syscall.
* Implemented decoding of 128-byte SQEs for io_uring_register syscall.
* Implemented decoding of socket operations (SOCKET_URING_OP_*) for
io_uring URING_CMD and URING_CMD128 operations when the file descriptor
is a socket.
* Updated decoding of struct mnt_id_req and struct perf_event_attr.
* Updated lists of ABS_*, BPF_*, ETHTOOL_*, ETH_P_*, IORING_*, KVM_*, PERF_*,
TLS_*, V4L2_*, and *_MAGIC constants.
* Updated lists of ioctl commands from Linux 6.19.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Tue, 30 Jun 2026 11:15:20 +0000 (13:15 +0200)]
postfix: Update to version 3.11.4
- Update from version 3.11.3 to 3.11.4
- No change to rootfile
- Changelog
3.11.4
Major changes - database
[Incompat 20260220] The alias_maps and alias_database parameter
default values have changed from hash:/path/to/aliases (or
dbm:/path/to/aliases) to $default_database_type:/path/to/aliases.
This simplifies the migration away from Berkeley DB.
[Infrastructure 20260219] Support to migrate a Postfix configuration
that uses Berkeley DB hash: or btree: tables, to a configuration
that uses lmdb: or a combination of cdb: and lmdb:. This is needed
for (Linux) OS distributions that have removed Berkeley DB support.
See NON_BERKELEYDB_README for manual and automatic migration support.
Postfix already supports CDB and LMDB for more than 10 years. It
may be a good idea to do the migration before you need to upgrade
to an OS distribution that no longer supports Berkeley DB.
[Infrastructure 20251226] Tooling to help with the migration away
from Berkeley DB.
The new parameter default_cache_db_type controls the default database
type for address_verify_map, postscreen_cache_map, and
smtp_sasl_auth_cache_name, previously hard-coded as 'btree'.
[Feature 20250321] Safety: the SQLite client now logs a warning
when a query uses double quotes instead of the Postfix-recommended
single quotes. Only the recommended form is protected against SQL
injection.
[Feature 20250509] Support to run all memcache lookup keys through
an OpenSSL digest function. This prevents a database access error
when lookup keys may exceed the memcache server's key length limit
(usually, 250 bytes).
[Feature 20250624] Support for a new "debug:" pseudo lookup table.
Specify debug:maptype:mapname to encapsulate a maptype:mapname
lookup table and log all access. This builds on existing but unused
code to log table access. Contributed by Richard Hansen.
[Infrastructure 20250626] Overhauled in-memory lookup table life-cycle
management; overhauled sharing/isolation for proxied lookup tables.
Major changes - deprecation
[Feature 20250609] smtp_tls_enforce_peername and lmtp_tls_enforce_peername
are now officially deprecated. Postfix will log a warning until the
features are deleted. See DEPRECATION_README for a summary of
deprecated and deleted features.
[Feature 20251027] This adds 12 more deprecation warnings for
parameters that have been renamed in the past, and that still provide
a backwards-compatible default value for their replacement. The
parameters deprecated by this change are: authorized_verp_clients,
fallback_relay, lmtp_per_record_deadline, postscreen_blacklist_action,
postscreen_dnsbl_ttl, postscreen_dnsbl_whitelist_threshold,
postscreen_whitelist_interfaces, smtpd_client_connection_limit_exceptions,
smtp_per_record_deadline, tlsproxy_client_level, tlsproxy_client_policy,
virtual_maps.
[Feature 20251028] Deprecate the smtp_cname_overrides_servername
and lmtp_cname_overrides_servername parameters, and delete documentation
that has been obsolete since Postfix 2.11.
Major changes - logging
[Feature 20250910] TLS feature policy status summary in delivery
status logging. This shows the desired and actual TLS security level
enforcement status and, if a message requests REQUIRETLS, the
REQUIRETLS policy enforcement status. For a list of examples see
https://www.postfix.org/postconf.5.html#smtp_log_tls_feature_status
[Feature 20251216] After a delivery failure, the bounce daemon
logged "<old-queue-id>: sender non-delivery notification: <new-queue-id>"
only if the notification was queued successfully. The bounce daemon
now always logs this, making Postfix behavior easier to understand.
Visible changes for logfile analyzers:
- The bounce daemon now logs "<old-queue-id>: sender non-delivery
notification: <new-queue-id>" BEFORE the cleanup daemon logs activity
with "<new-queue-id>". Previously, the bounce daemon logged the
old<=>new queue ID connection later, which made logfile analysis
more difficult.
- The bounce daemon now logs a logfile record "<old-queue-id>:
sender notification failed to <address>: <reason>" when the
notification was not queued. In some cases it will log "<old-queue-id>:
sender notification failed to <address>" (without the reason). In
those cases the failure reason was already logged by lower-level
code, but without the queue ID.
Major changes - management tool integration
[Feature 20251124] Basic JSON output support with "postconf
-j|-jM|-jF|-jP", "postalias -jq|-js", "postmap -jq|-js", and
"postmulti -jl". No support is planned for JSON input support.
Major changes - milter support
[Feature 20251208] Improved Milter error handling for messages that
arrive over a long-lived SMTP connection, by changing the default
milter_default_action from "tempfail" to the new "shutdown" action
(i.e. disconnect the remote SMTP client).
This avoids a worst-case scenario where after a single Milter error,
Postfix would tempfail all messages that the client sends over a
long-lived connection, even if the Milter error was only temporary.
Major changes - mime support
[Feature 20251104] New non_empty_end_of_header_action parameter
with the cleanup(8) server action when a primary message header is
terminated with a non-empty line:
1) fix_quietly: Insert an empty line before the offending text (the
backwards-compatible default),
2) add_header: Insert a MIME-Error: header before inserting an empty
line, or
3) reject: Log a "mime-error" and reject the message.
Note that the 'empty line' separator is not used for DKIM signature
checks. Therefore, adding a missing separator does not break DKIM.
Major changes - mta-sts
[Feature 20250906] Workaround for an interface mis-match between
the Postfix SMTP client and MTA-STS policy plugins. This introduces
a new parameter "smtp_tls_enforce_sts_mx_patterns" (default: "yes").
The MTA-STS plugin configuration needs to enable TLSRPT support,
so that it forwards STS policy attributes to Postfix. This works
even if Postfix TLSRPT support is disabled at build time or at
runtime.
With the above two configurations, the Postfix SMTP client will
connect to an MX host only if its name matches any STS policy MX
host pattern, and will match a server certificate against the MX
hostname. Otherwise, the old behavior stays in effect: connect to
any MX host listed in DNS, and match a server certificate against
any STS policy MX host pattern.
This code was published first in Postfix 3.11, and later back-ported
to Postfix 3.10.5.
Major changes - portability
[Feature 20241201] Support for the C23 built-in bool type. Older
Postfix releases have been updated with a makedefs script that
disables C23 built-in bool support.
Major changes - postqueue
[Feature 20251218] the postqueue (and mailq) command now also lists
recipients in bounce logfiles (in JSON output, this uses a new
object member 'bounce_reason' instead of the existing 'delay_reason').
Such recipients have already been deleted from the message queue
file, but they are still pending the creation of a non-delivery
status notification message that will be returned to the sender.
Major changes - relocated_maps
[Feature 20250608] Specify "relocated_prefix_enable = no" to disable
the hard-coded prefix "5.1.6 User has moved to " that is by default
prepended to all relocated_maps lookup results. This setting requires
that the table contains responses with both custom enhanced status
code (X.Y.Z) and text. For details, see "man 5 relocated" or
https://www.postfix.org/relocated.5.html .
Major changes - requiretls
[Feature 20241111] Support for the REQUIRETLS verb in SMTP. This,
and everything that was added later through 2025, is described in
REQUIRETLS_README.
[Feature 20250120] After a certificate check fails, or a remote
SMTP server does not announce REQUIRETLS support, the Postfix SMTP
client will override the RFC 8689 5.x.x. status and treat it as a
soft error, until there are no more alternate MX servers to try.
[Feature 20250827] New parameter requiretls_redact_dsn (default:
yes) to redact bounce messages as described in RFC 8689 section 5,
so that they don't need REQUIRETLS support on every hop in the
return path.
[Feature 20250827] smtp_requiretls_policy and lmtp_requiretls_policy
for responsible REQUIRETLS policy enforcement. REQUIRETLS must be
enforced with care, because at this time most domains do not publish
DANE or MTA-STS policies, and most MTAs and content filters do not
support REQUIRETLS.
[Feature 20250916] support for a "Require-TLS-ESMTP: yes" header
to propagate an ESMTP REQUIRETLS request through a FILTER_README
or SMTPD_PROXY_README style content filter. This header is detected
or added by the cleanup daemon and by the before-proxy-filter Postfix
SMTP server. This feature is enabled by default with
"requiretls_esmtp_header = yes". The Require-TLS-ESMTP header will
be visible to local and remote recipients. This feature can safely
be disabled when a configuration does not use REQUIRETLS, or does
not use FILTER_README or SMTPD_PROXY_README style content filters.
Major changes - smtp server
[Feature 20250801] smtpd_reject_filter_maps support to selectively
replace a reject response from the Postfix SMTP server, or from a
program that replies through the Postfix SMTP server.
Major changes - smtputf8
[Feature 20250122] New Postfix sendmail command option "-O smtputf8"
to request that deliveries over SMTP use the SMTPUTF8 extension.
This reuses logic that was introduced for REQUIRETLS.
[Feature 20250824] When a message needs to be delivered with SMTPUTF8,
but a remote server does not support it, the Postfix SMTP client
may now try alternate servers instead of returning the message
immediately. This reuses code that was implemented for REQUIRETLS.
Major changes - tls support
[Feature 20250623] This changes the Postfix SMTP client
smtp_tls_security_level default value to "may" if Postfix was built
with TLS support, and the compatibility_level is 3.11 or higher.
There is no change to the default lmtp_tls_security_level value.
It remains empty, because there is no default TLS security level
that makes sense for connections over UNIX-domain and loopback TCP
and non-loopback TCP sockets.
There also is no equivalent change for Postfix SMTP server TLS
security levels, because changing smtpd_tls_security_level is not
sufficient. Server-side TLS requires that at least one private key
and corresponding public-key certificate chain are configured.
[Feature 20251029] Debugging: depending on OpenSSL build options,
"posttls-finger -L ssl-debug" will decode TLS handshake messages.
[Feature 20251102] Post-quantum cryptography support: with OpenSSL
3.5 and later, change the tls_eecdh_auto_curves default value to
avoid problems with network infrastructure that mis-handles TLS
hello messages larger than one (Ethernet) TCP segment. This problem
is more generally known as "protocol ossification".
Major changes - tlsrpt
[Incompat 20250601] the default smtp_tlsrpt_skip_reused_handshakes
setting was changed from "yes" to "no". The new default is enabled
with compatibility level >= 3.11.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Tue, 30 Jun 2026 11:15:23 +0000 (13:15 +0200)]
sysstat: Update to version 12.7.9
- Update from version 12.7.6 to 12.7.9
- Update of rootfile
- Changelog
12.7.9
* sar: Fix pgsteal/s double value with recent kernels.
* Allow Truecolor (RGB) SGR codes in sysstat commands output.
* Don't display newline character within SGR-formatted text.
* Rework several functions based on Mistral AI Le Chat's suggestions.
* [Jun Lyu]: Fix missing dependencies in Makefile.in.
* mpstat: No longer call get_HZ() function.
* sar: Close file descriptors on fork() error.
* Fix version number in sysstat.xsd document.
* Check passed args in some functions.
* common.c: Include ioconf.h header file only if SOURCE_SADC is
defined.
* Mark various variables as constant.
* Improve code clarity and readability.
* Exit if calling sysconf() function fails.
* Create format strings using string's real max value.
* simtest: Fix gcc warning in legacy sar version.
* Update sar and sadf manual page.
* Update FAQ.
* NLS: Translations updated.
* Update non regression tests.
12.7.8
* sar/sadf: Add new metric kbshmem.
* sar/sadf: Now compute used memory as total memory - available memory.
* sadf: Set availablekb to frmkb during conversion.
* cifsiostat, iostat, mpstat, tapestat: Add new option -U to display
timestamps in seconds since the Epoch.
* Trap SIGTERM with all sysstat commands.
* mpstat: Go to next line when Ctrl/C is pressed.
* Add support for out-of-tree building and testing.
* sar: A_PWR_BAT: Fix wrong size used in memory initialization.
* Makefile.in: Update dependencies for install_man target.
* Makefile.in: Remove unused TFLAGS variable.
* Makefile.in: Remove old references to nfsiostat.
* DTD and XSD documents updated.
* NLS translations updated.
* sar, mpstat, iostat, cifsiostat and tapestat manual pages updated.
* Various cosmetic changes in code and Makefile.
* do_test: Add test target for out-of-tree build.
* systest: Explicitly set signal to SIGINT.
* Non regression tests: Remove root symlink in tests directory.
* Non regression tests updated.
12.7.7
* Rework overflow check function.
* pidstat: Add JSON output format (option "-o JSON").
* [Siddhi Katage]: pidstat: Fix bogus %usr values in pidstat output.
* pidstat: Free structures before exiting.
* pidstat: Make sure interval is specified when option -e is used.
* pidstat: Create separate functions to display data for current task.
* pidstat: Various cosmetic changes.
* cifsiostat: Add JSON output format (option "-o JSON").
* cifsiostat: Display error message when no CIFS fs are found.
* cifsiostat: Add new option -y to tell cifsiostat to omit the first
report with statistics since system restart.
* tapestat: Add JSON output format (option "-o JSON").
* tapestat: Set handler for SIGALRM in rw_tape_stat_loop() function.
* tapestat: Call write_sample_timestamp() to display timestamp.
* mpstat: Properly terminate JSON output when ^C entered on first
interval.
* iostat: Remove extra blank line when omitting first report.
* cifsiostat, tapestat and pidstat manual pages updated.
* Use the binary units (kibibytes, mebibytes...) instead of kilobytes,
megabytes... in all manual pages.
* FAQ updated.
* [Peter Portante]: Slight changes to compile on Mac OS X.
* [Peter Portante]: Add missing "void" parameter to
init_custom_color_palette() function.
* Use xflags variable for options used by multiple commands.
* Move write_sample_timestamp() function to common.c file.
* Update headers files included.
* Add new non regression tests.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Tue, 30 Jun 2026 11:15:19 +0000 (13:15 +0200)]
file: Update to version 5.48
- Update from version 5.47 to 5.48
- No change to rootfile
- Changelog
5.48
* add landlock support (valoq)
* add BE/LE GUID
* multiple fixes to prevent integer overflow in 32 bits (kerwin)
* PR/745: streamout: Don't flush when trying to set negative offsets
on pipes, just continue, fixes 'cat file.zip | file -'
* PR/753: vmihalko: Fix race is magic_getpath()
* PR/728: Anton Monroe: Reinstate regex/c
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Tue, 30 Jun 2026 11:15:18 +0000 (13:15 +0200)]
fetchmail: Update to version 6.6.5
- Update from version 6.6.0 to 6.6.5
- No chyange to rootfile
- Changelog
6.6.5
SECURITY BUGFIX
* POP3 with RPA: fix calculation of buffer sizes to avoid buffer overflow
on long service challenges with long user IDs, which would smash our stack.
Triggering this requires that 1. RPA is enabled at compile time
(non-default, which is discouraged in autotools, and possible but not
documented nor supported in meson), and the username (--user option, or user
in the rcfile) contains @compuserve.com anywhere, and the server supports an
AUTH command without arguments (which is a non-standard local extension), and
that it offers RPA authentication in response to that command.
This was reported based on an incomplete semi-wrong AI report with an
incomplete fix "recommendation" by zhangph12138@outlook.com via
fetchmail-devel@. The fix suggested in that AI report was wrong, and
would happily crash a few lines later again. The fix deployed calculates
the buffer size of "workarea" variables based on the sizeof() of constituent
components.
BUGFIX
* Robustness: If RPA is enabled at compile time and POP3 is in use,
do not barf if @compuserve.com is in the remote site's username (what you'd
pass as --user, or user in the rcfile) and the remote site either does not
support an "AUTH" command without parameters (normally, one is required, but
some servers such as jpop and Cyrus allow AUTH to request the list of
supported authentication types as an extension; the standard way would be
a "CAPA" request instead), but try other authentication methods.
Found by code auditing in response to a bug report against rpa.c.
Note that enabling RPA is discouraged because it is based on the weak
MD5 crypto algorithm.
6.6.4
BUGFIX
* The IMAP client will now properly quote the folder name given with the
moveto rcfile option, or --moveto command-line option.
Report and bugfix contributed by Corben Dallas.
BUILD IMPROVEMENTS
* meson-based builds with wolfSSL should now also work when meson finds
the wolfssl package through cmake, instead of pkgconfig. This is unsupported
and depends on internal set(_wolfssl_includedir "...") in wolfSSL's
lib/cmake/*.cmake files, and works as of wolfSSL 5.9.1.
The supported way to build fetchmail with wolfSSL with meson is
to make sure that wolfSSL is found with pkgconfig, as in (change /path/to!)
meson setup --pkg-config-path /path/to/wolfssl/lib/pkgconfig
EXPERIMENTAL CHANGES - these are not documented anywhere else, only here:
* fetchmail supports AWS-LC 1.71 or newer, since its relicensing to
the Apache license v2.0. Note this requires you to distribute fetchmail
under terms of the GPLv3 because the GPLv2 is claimed incompatible
with Apache license (this is no different for OpenSSL 3 or newer,
or the one wolfSSL version that was GPLv3 licensed).
* fetchmail supports a FETCHMAIL_SSL_SECLEVEL environment variable
(since 6.5.0, except when using AWS-LC where it is silently ignored),
which can be used to override the OpenSSL security level.
Fetchmail by default raises the security level to 2 if lower.
This variable can be used to lower it.
Use with extreme caution. Note that levels 3 or higher will frequently cause
incompabilities with servers because server-side data sizes are often too low.
Valid range: 0 to 5 for OpenSSL 1.1.1 and 3.0.
* fetchmail supports a FETCHMAIL_SSL_CIPHERS environment variable
(since 6.5.0) that sets the cipher string (through two different OpenSSL
functions) for SSL and TLS versions up to TLSv1.2.
If setting the ciphers fails, fetchmail will not connect.
If not given, defaults to "HIGH:MEDIUM:+RC4:@STRENGTH:!aNULL" - note
that +RC4 is supposed to move the RC4 to the end of the list, not add it.
* fetchmail supports a FETCHMAIL_TLS13_CIPHERSUITES environment variable
(since 6.5.0) that sets the ciphersuites (a colon-separated list,
without + ! -) for TLSv1.3. If not given, defaults to the SSL library's
built-in list. If setting the ciphersuites fails, fetchmail refuses to
connect.
* NOTE the features above are simplistic. For instance, even though you
configure --sslproto tls1.3, a failure to set tls1.2 ciphers could cause
a connection abort.
6.6.3
COMPATIBILITY:
* fetchmail can now be built with OpenSSL 4.0.0 (tested as of -beta1).
6.6.2
BUGFIX:
* fetchmail 6.6.0 and 6.6.1 could not be configured without SSL, it would break
compiling sink.c. Fix compilation. Report by Toralf Förster, analysis and
different patch suggested by Holger Hoffstätte, fixes #86.
https://bugs.gentoo.org/967258 and
https://gitlab.com/fetchmail/fetchmail/-/issues/86
6.6.1
TRANSLATIONS were updated by these fine people (randomized order):
* sr: Мирослав Николић [Serbian]
* es: Cristian Othón Martínez Vera [Spanish]
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Tue, 30 Jun 2026 11:15:17 +0000 (13:15 +0200)]
expat: Update to version 2.8.2
- Update from version 2.8.1 to 2.8.2
- Update of rootfile
- 13 CVE fixes
- Changelog
2.8.2
Security fixes:
#1246 CVE-2026-50219 -- Disallow calls to functions
`XML_GetBuffer`, `XML_Parse`, `XML_ParseBuffer`,
`XML_ParserFree`, `XML_ParserReset` to guard e.g.
Expat bindings from memory corruption;
this CPython issue is related:
https://github.com/python/cpython/issues/146169
#1267 CVE-2026-56131 -- Protect XML_ResumeParser from being called
from a handler, plugging a hole in the fix
to CVE-2026-50219
#1272 CVE-2026-56132 -- Fix out-of-bound scaffolding index store
in `doProlog`
#1229 #1232 CVE-2026-56403 -- Integer overflow in `storeAtts`
#1249 CVE-2026-56404 -- Integer overflow in `addBinding`
#1251 CVE-2026-56405 -- Integer overflow in `getAttributeId`
#1255 CVE-2026-56406 -- Integer overflow in `XML_ParseBuffer`
#1262 CVE-2026-56407 -- Integer overflow in `textLen` handling
#565 CVE-2026-56408 -- Integer overflow in `copyString`
(commit 16e2efd867ea8567ffa012210b52ef5918e20817)
#1259 CVE-2026-56409 -- xmlwf: Integer overflow in output path join
#1252 CVE-2026-56410 -- xmlwf: Integer overflow in
`resolveSystemId`
#1263 CVE-2026-56411 -- xmlwf: Integer overflow in notation list
allocation
#1278 CVE-2026-56412 -- Guard XML_TOK_DATA_CHARS handler calls in
`doCdataSection`, plugging a hole in the fix to
CVE-2026-50219
Bug fixes:
#1260 xmlwf: Escape names and base URI in meta output
#1266 xmlwf: Pick a safe quote for notation system and public IDs
Other changes:
#1257 CMake|Autotools: Stop using /dev/urandom by default
#1244 #1254 CMake: Fix guard for Unix sources of entropy
#1183 #1270 CMake|Windows: Add missing export for symbol
`XML_SetHashSalt16Bytes`
#1236 CMake: Mark option EXPAT_OSSFUZZ_BUILD as advanced
#1283 Limit output indentation for EXPAT_ENTITY_DEBUG=1 and
allow unlimited indentation via EXPAT_ENTITY_DEBUG=2
#565 Replace some loops by use of `memcpy`, `strlen`, `wcslen`
#1220 lib: Use a size_t for group sizes
#1221 lib: Fix too-conservative integer overflow check when
appending raw name
#1222 lib: Simplify attribute allocation/management logic
#1224 Update fallthrough annotations to satisfy Clang and GCC
#1226 lib: Remove unnecessary void * casts in random code
#1228 lib: Reduce scope of locals in storeAtts
#1230 lib: Count attributes with size_t variables
#1238 Minor get-buffer improvements
#1239 #1240 lib|tests: Include header expat_config.h first
#1241 lib: Shrink size of XML_GetBuffer
#1242 lib: Remove a legacy comment
#1243 lib: XML_ParserReset: Extract repeated linked-list move logic
#1243 lib: Unify entity free lists
#1247 lib: Fix use of '0' as boolean literal
#1248 lib: Make XML_Index overflow check more intuitive
#1256 lib: Use size_t for counting string/URI lengths
#1258 lib: XML_GetInputContext: Remove use of 0 for NULL
#1261 Comment typo fixes
#1275 Teach Memory Sanitizer semantics of randomization functions
#1276 #1281 Version info bumped from 13:1:12 (libexpat*.so.1.12.1)
to 13:2:12 (libexpat*.so.1.12.2); see https://verbump.de/
for what these numbers do
Infrastructure:
#1231 perl-integration.yml: Bump to XML::Parser 2.59
#1237 emscripten.yml: Bump from Ubuntu 22.04 to 24.04
#1183 #1271 windows-build.yml: Cover completeness of file
libexpat.def.cmake
#1274 linux.yml: Make llvm-symbolizer available in CI
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Tue, 30 Jun 2026 11:15:16 +0000 (13:15 +0200)]
elinks: Update to version 0.19.1
- Update from version 0.19.0 to 0.19.1
- No change to rootfile
- Changelog
0.19.1
* compilation fixes for Ruby scripting #410
* Disable poll on macOS < 10.6
* bookmarks xbel did not restore positions. #415
* use after free in forms code
* NULL dereference in iframes code (crash at github) #418
* Add action move-cursor-line-end. #416
* bool option document.browse.wrap. #420
* bool options ui.clipboard.remove_leading_spaces and
ui.clipboard.remove_trailing_spaces #416
* Serbian translation update
* fix in gopher #421
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Robin Roevens [Thu, 18 Jun 2026 17:58:34 +0000 (19:58 +0200)]
zabbix_agentd: Add support for kresd metrics
Add new UserParameter ipfire.kresd.stats.get for retrieval of kresd metrics using curl over unix-sockert.
Add curl command to sudoers for Zabbix agent to be able to access the unix-socket.
Signed-off-by: Robin Roevens <robin.roevens@disroot.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Remove ineffective TCP fallback after repeated UDP timeouts.
When an authoritative server failed to respond to two consecutive UDP
queries, named marked the next retry as TCP but still sent it over UDP,
producing misleading dnstap records. The ineffective retry path has
been removed; a corrected TCP fallback will be restored in future BIND
9 versions. [GL #5529]
Feature Changes
Fall back to TCP on receipt of a UDP response with a mismatched query
ID.
BIND used to wait silently for the correct DNS message ID on a UDP
fetch, even after receiving a response from the expected server with
the wrong ID, leaving room for off-path spoofing attempts to keep
guessing within that window. The resolver now retries the fetch over
TCP on the first such response, and a new MismatchTCP statistics
counter tracks how often the fallback fires. [GL #5449]
Limit the number of glue records cached from a referral.
When a delegation response contained many glue addresses per listed
nameserver, all of them were cached without a per-nameserver bound,
inflating resolver cache memory beyond what resolution could ever use.
The cache now keeps at most 20 IPv4 and 20 IPv6 glue addresses per
nameserver from a delegation. [GL #5701]
Fix a resolver stall on a CNAME response to a DS query.
A validating resolver could stall for about twelve seconds and then
return SERVFAIL when an authoritative server answered a DS query with a
CNAME. Such responses are now rejected promptly, so the query fails
quickly instead of hanging. [GL #5878]
Bug Fixes
The resolver now removes other RRsets at the same name when caching a
CNAME.
When an RRset is in stale cache and the authoritative server changes
the record type to CNAME, the resolver fails to refresh the stale
cache. This has been fixed. [GL #5302]
Fix nxdomain-redirect combined with dns64.
When a resolver was configured with both nxdomain-redirect and dns64 in
the same view, an AAAA query for a nonexistent name could abort named.
The combination failed whenever the redirect zone held A records but no
AAAA records. The server now serves the empty AAAA response from the
redirect zone as-is, instead of attempting DNS64 synthesis on top of
it. [GL #5789]
Fix DNS64 owner case after DNAME restart.
When BIND 9 was configured to use DNS64 and encountered a DNAME
redirect, it could end up using freed memory for the DNS response owner
name. This caused the response to contain corrupted data. This fix
ensures the correct owner name is used when constructing the
synthesized response after a DNAME redirect. [GL #5934]
Clear REDIRECT flag when it isn't needed.
When nxdomain-redirect is in use, and a recursive query is used to get
the redirected answer, a flag is set to distinguish it from a normal
recursive response. Previously, that flag was left set afterward, which
could trigger an assertion if a normal recursive query was sent later
on behalf of the same client: for example, because the filter-aaaa
plugin was in use. This has been fixed. [GL #5936]
Disable output escaping in bind9.xsl.
The statistics charts were not displaying on some browsers. This has
been fixed. [GL #5990]
Fix crash on badly configured secondary signer.
A badly configured secondary signer that was missing the file entry
caused the server to crash, rather than to reject the configuration.
This has been fixed. [GL #5993]
Fix a possible crash on concurrent TKEY DELETE for the same key.
On a server configured with tkey-gssapi-keytab, an authenticated peer
could crash named by sending two TKEY DELETE requests for the same
dynamic key in rapid succession. This has been fixed. [GL #6001]
Reject RRSIG records covering meta-types.
A recursive resolver could accept and cache an RRSIG record whose
Type-Covered field named a meta-type (ANY, AXFR, IXFR, MAILA, MAILB),
even though no real RRset of those types ever exists. Such records are
now rejected by the DNS message parser. [GL #6002]"
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Fri, 12 Jun 2026 17:30:44 +0000 (19:30 +0200)]
openssl: Update to version 3.6.3
- Update from version 3.6.2 to 3.6.3
- Update of rootfile
- Changelog
3.6.3
OpenSSL 3.6.3 is a security patch release. The most severe CVE fixed
in this release is High.
This release incorporates the following bug fixes and mitigations:
Fixed heap use-after-free in PKCS7_verify().
(CVE-2026-45447)
Fixed CMS AuthEnvelopedData processing may accept forged messages.
(CVE-2026-34182)
Fixed unbounded memory growth in the QUIC PATH_CHALLENGE handler.
(CVE-2026-34183)
Fixed double-free when checking OCSP stapled response.
(CVE-2026-35188)
Fixed NULL pointer dereference in QUIC server initial packet handling.
(CVE-2026-42764)
Fixed AES-OCB IV ignored on EVP_Cipher() path.
(CVE-2026-45445)
Fixed possible heap buffer overflow in ASN.1 multibyte string conversion.
(CVE-2026-7383)
Fixed out-of-bounds read in CMS password-based decryption.
(CVE-2026-9076)
Fixed heap buffer over-read in ASN.1 content parsing.
(CVE-2026-34180)
Fixed PKCS#12 files with PBMAC1 are accepted with short HMAC keys.
(CVE-2026-34181)
Fixed NULL dereference in certificate verification with OCSP Checking.
(CVE-2026-42765)
Fixed possible NULL dereference in password-dased CMS decryption.
(CVE-2026-42766)
Fixed NULL pointer dereference in CRMF EncryptedValue decryption.
(CVE-2026-42767)
Fixed multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt()
and PKCS7_decrypt().
(CVE-2026-42768)
Fixed trust anchor substitution via cert/issuer typo in CMP
rootCaKeyUpdate.
(CVE-2026-42769)
Fixed FFC-DH peer validation uses attacker-supplied q.
(CVE-2026-42770)
Fixed incorrect tag processing for empty messages in AES-GCM-SIV
and AES-SIV modes.
(CVE-2026-45446)
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Fri, 12 Jun 2026 17:30:44 +0000 (19:30 +0200)]
openssl: Update to version 3.6.3
- Update from version 3.6.2 to 3.6.3
- Update of rootfile
- Changelog
3.6.3
OpenSSL 3.6.3 is a security patch release. The most severe CVE fixed
in this release is High.
This release incorporates the following bug fixes and mitigations:
Fixed heap use-after-free in PKCS7_verify().
(CVE-2026-45447)
Fixed CMS AuthEnvelopedData processing may accept forged messages.
(CVE-2026-34182)
Fixed unbounded memory growth in the QUIC PATH_CHALLENGE handler.
(CVE-2026-34183)
Fixed double-free when checking OCSP stapled response.
(CVE-2026-35188)
Fixed NULL pointer dereference in QUIC server initial packet handling.
(CVE-2026-42764)
Fixed AES-OCB IV ignored on EVP_Cipher() path.
(CVE-2026-45445)
Fixed possible heap buffer overflow in ASN.1 multibyte string conversion.
(CVE-2026-7383)
Fixed out-of-bounds read in CMS password-based decryption.
(CVE-2026-9076)
Fixed heap buffer over-read in ASN.1 content parsing.
(CVE-2026-34180)
Fixed PKCS#12 files with PBMAC1 are accepted with short HMAC keys.
(CVE-2026-34181)
Fixed NULL dereference in certificate verification with OCSP Checking.
(CVE-2026-42765)
Fixed possible NULL dereference in password-dased CMS decryption.
(CVE-2026-42766)
Fixed NULL pointer dereference in CRMF EncryptedValue decryption.
(CVE-2026-42767)
Fixed multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt()
and PKCS7_decrypt().
(CVE-2026-42768)
Fixed trust anchor substitution via cert/issuer typo in CMP
rootCaKeyUpdate.
(CVE-2026-42769)
Fixed FFC-DH peer validation uses attacker-supplied q.
(CVE-2026-42770)
Fixed incorrect tag processing for empty messages in AES-GCM-SIV
and AES-SIV modes.
(CVE-2026-45446)
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Matthias Fischer [Sat, 13 Jun 2026 23:12:28 +0000 (01:12 +0200)]
knot: Update to 3.5.5
For details see:
https://www.knot-dns.cz/2026-06-12-version-355.html
"Version 3.5.5
Friday, June 12, 2026
Features:
knotd: support for binding wildcard addresses to a specific network interface
mod-alias: ALIAS record synthesis from locally served targets (Thanks to Bron Gondwana) !1867
Improvements:
knotd: zone XFR freeze state is persistent across restarts by storing it in timers
knotd: optimized rescheduled DNSSEC validation
knotd: hardened manually triggered DNSSEC validation
utils: configuration detection fails if the database is empty or inaccessible
utils: LMDB reader lock table is purged even for read-only access
utils: errors when writing to stdout are reported
libs: upgraded embedded libngtcp2 to 1.23.0
doc: various improvements
Bugfixes:
knotd: missing mutex lock in server startup check
knotd: server crashes if the QUIC client limit is lower than the number of UDP workers
knotd: misleading error log for DS check #969
knotd: empty catalog database is created when purging orphans
knotd: false error report when there is no journal during purging orphans
knotd: the '--' specification doesn't work with 'zone-serial-set' and 'zone-key-rollover'
knotd: zone backup prevents timer dumping, resulting in inconsistent timers
knotd: zone reload causes timer dumping to be skipped
knotd: segfault on SIGTERM if periodic statistics dumping is enabled #972
knotd: redundant RRSIGs are removed during DNSSEC validation
knotd: missing AA flag in AXFR and IXFR responses
libknot: unnecessary increase in library size
libdnssec: memory leak when PEM key generation fails
libknot: undefined behavior in QUIC data stream processing
libknot: assertion failure in QUIC connection handling under high load
mod-geoip: inconsistent behavior for specific records and ANY queries #971
redis: incorrect filter parameter parsing in KNOT.UPD.LOAD commands
redis: database crashes if it's built with jemalloc
kdig: undefined behavior if both +https and +quic are specified
kxdpgun: crash when reusing a swept-out QUIC connection"
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Matthias Fischer [Fri, 12 Jun 2026 17:14:32 +0000 (19:14 +0200)]
Net-DNS: Update to 1.55
This is an update from v1.30 => v1.55 - changelog is rather long...
For details see:
https://www.net-dns.org/svn/net-dns/release/1.55/Changes
"**** 1.55 Jun 11, 2026
Fix UDP truncation tests which relied on large RSA RRSIGs.
Fix rt.cpan.org #178183
Unhelpful TAINT error
Fix rt.cpan.org #177003
TCP read loop treats 1-byte recv() of "0" (0x30) as EOF, corrupting AXFRs
Fix rt.cpan.org #176900
UNIX.pm: avoid `backticks` which depends on shell
**** 1.54 Jan 16, 2026
Resync with IANA DNS parameters registry.
Resync with IANA DNSSEC algorithms registry.
Backport DELEG parser to SVCB.
**** 1.53 Aug 29, 2025
Suppress autovivified undefined $rr->{class} and $rr->{ttl}.
Rework test scripts for SVCB and DELEG.
**** 1.52 Jul 29, 2025
Refactor SVCB to avoid internal use of generic keyNN.
DELEG documentation and code improvement.
Fix rt.cpan.org #168433
Bug in resolver base selection on non-Unix/Linux platforms
**** 1.51 Jul 4, 2025
Resync with IANA DNS Parameters registry.
Add prototype DELEG RR package.
Minor code and documentation improvements.
**** 1.50 Feb 21, 2025
Minor code improvements in Resolver::Base.
Add RESINFO package for resolver information.
Documentation revision and reformatting.
Fix rt.cpan.org #158714
Fedora41: IPv4 loopback disabled in IPv6-only configuration
Fix rt.cpan.org #158706
Use of uninitialized value [in _send_udp]
**** 1.49 Dec 27, 2024
Add DSYNC package for Generalized Notification.
EDNS: Add support for ZONEVERSION option.
Fix rt.cpan.org #157700
"Use of uninitialized value" errors when using TCP connections
Fix rt.cpan.org #157669
Net::DNS::Nameserver: SOA not present in NODATA response
Fix rt.cpan.org #157195
EDNS option structure does not match JSON from $packet->edns->print
Fix rt.cpan.org #157043
User-hostile return value from SVCB key methods
**** 1.48 Nov 8, 2024
SVCB: Add tls-suppored-groups parameter.
Fix failures in 01-resolver.t dry tests.
**** 1.47 Sep 18, 2024
Restore current domain name following $INCLUDE in zone file.
Update RFC and other document references.
Fix rt.cpan.org #155337
Issue with parallel run of TSIG tests
**** 1.46 Aug 19, 2024
Resync with IANA DNS Parameters registry.
Revise documentation for Packet.pm and Header.pm.
Random ID cache moved from header->id to packet->encode.
Restructure resolver method inheritance tree.
**** 1.45 May 2, 2024
Resync with IANA DNSSEC Algorithm Numbers registry.
Resync with IANA DS Digest Algorithms registry.
Add support for EDNS CO flag.
Fix rt.cpan.org #152756
Net::DNS::Resolver::UNIX creates $ENV{PATH} key if one doesn't exist
**** 1.44 Feb 15, 2024
Simplify testing of resolver error paths.
Prevent read beyond end of RDATA in corrupt SVCB RR.
**** 1.43 Jan 26, 2024
Update b.root-servers.net addresses in resolver hints.
Improve accuracy and completeness of dependency metadata.
Nameserver: hangs on persistent TCP connection (Windows).
IPSECKEY: leave gateway undefined for gatetype 0.
Remove remaining support for GOST.
Fix rt.cpan.org #151240
Nameserver.pm: DoS vulnerability in TCP handling
Fix rt.cpan.org #151232
Net::DNS::Resolver::new hangs for 150s on Win32 with no active DNS
Fix rt.cpan.org #151075
Bug in Net::DNS::Resolver::Recurse::_referral
Fix rt.cpan.org #151074
Deep recursion in Net::DNS::Resolver::Recurse
**** 1.42 Dec 24, 2023
Fix rt.cpan.org #150695
Hang in Net::DNS::Nameserver on Windows
**** 1.41 Nov 28, 2023
Accept inbound Ethernet "Jumbo" UDP packet.
Facilitate decoding of mDNS/SD packets with compressed RDATA.
Update Parameters.pm to resync with IANA registry.
Fix rt.cpan.org #150550
Error trying to use Socket macro SO_REUSEPORT in Windows
**** 1.40 Aug 30, 2023
Add support for SVCB dohpath and ohttp parameters.
More robust test of bgbusy() SpamAssassin workaround.
Fix rt.cpan.org #149456
t/05-SOA.t test fails in 2038
Fix rt.cpan.org #149280
Deep recursion on subroutine "Net::DNS::Resolver::Recurse::_recurse"
**** 1.39 Jun 1, 2023
Fix rt.cpan.org #148340
udpsize uninitialized value
**** 1.38 May 9, 2023
Mailbox.pm: Improve robustness of address parsing.
Deprecate packet->edns->size() method.
Deprecate rdatastr() historical RR subtype method.
Major overhaul of pre-installation test scripts.
Add new t/TestToolkit.pm
Refactor socket code and control structure in
Nameserver.pm and improve efficiency of zonefile
data storage and retrieval.
Fix rt.cpan.org #148274
Multicast DNS flag breaks Net::DNS::Parameters::classbyval
Fix rt.cpan.org #148273
EDNS extended rcode not handled correctly
Fix rt.cpan.org #147507
Nameserver.pm: peerhost undefined after $sock->accept
**** 1.37 Mar 13, 2023
Add links to relevant RFCs in package documentation.
Fix rt.cpan.org #145944
Case sensitivity issue with AXFR
**** 1.36 Dec 30, 2022
Adopt JSON as presentation notation for EDNS options.
Disallow zero packet->id in outbound packet.
Remove deprecated 2-argument TSIG->create() method.
Revise TSIG test scripts and documentation.
**** 1.35 Oct 4, 2022
Improve SVCB error reporting.
Fix rt.cpan.org #144328
accept_reply test fails with matched consecutive "random"
generated packet->id
Fix rt.cpan.org #144299
Spelling errors.
**** 1.34 May 30, 2022
Improve robustness of EDNS option compose/decompose functions.
Simplify code in Makefile.PL.
Fix rt.cpan.org #142426
Avoid "Useless use of a constant in void context" warning.
**** 1.33 Dec 16, 2021
Fix rt.cpan.org #137768
Test t/05-SVCB.t on Perl 5.18.0 fails with deep recursion.
Fix rt.cpan.org #144136/#132921
$resolver->send wrongly overwrites RD flag in user's packet.
**** 1.32 Jul 16, 2021
Text: Offer both Unicode and escaped-ASCII strings.
Add LICENSE file to comply with Fedora/RedHat announcement.
Fix rt.cpan.org #136666
Net::DNS::RR::ZoneFile parser erroneously strips line
terminators in quoted string forming part of multiline RR.
**** 1.31 May 2, 2021
Improve implementation of SVCB record."
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Wed, 10 Jun 2026 19:02:00 +0000 (21:02 +0200)]
wireless-regdb: Update to version 2026.05.30
- Update from version 2026.02.04 to 2026.05.30
- No change in rootfile
- Changelog
2026.05.30
wireless-regdb: Update regulatory rules for Sri Lanka (LK)
wireless-regdb: Update regulatory info for Brunei Darussalam (BN) for 2022
wireless-regdb: allow 320MHz channel width for Russia
wireless-regdb: Update 6 GHz rules for South Korea (KR)
wireless-regdb: Update 6 GHz rules for South Africa (ZA)
wireless-regdb: Fix 60 GHz power unit for Ukraine (UA)
wireless-regdb: Update 5/6 GHz power rules for Russia (RU)
wireless-regdb: Update 6 GHz rules for Hong Kong (HK)
wireless-regdb: Add regulatory info for CEPT countries FO, GI, IM, SM and VA ...
2026.03.18
wireless-regdb: Update regulatory rules for India (IN) on 6GHz
wireless-regdb: Replace M2Crypto with cryptography package
wireless-regdb: Fix regulatory.bin signing with new M2Crypto
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from version 350100 to 350200
- Update of rootfile
- Changelog
350200
Fixes for problems in 3.53.0 reported by users. See the check-in timeline for details.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Wed, 10 Jun 2026 19:01:58 +0000 (21:01 +0200)]
less; Update to version 704
- Update from version 702 to 704
- No change to rootfile
- Changelog
704
Fix possibly passing unsafe options to man when opening an OSC 8 link
(github #779).
Fix possibly sending unsafe OSC sequence to terminal when file contains an
unterminated OSC sequence (github #781).
In Examine and Shell commands, expand % and # to shell-escaped filenames
(github #784).
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Wed, 10 Jun 2026 19:01:57 +0000 (21:01 +0200)]
kbd: Update to version 2.10.0
- Update from version 2.9.0 to 2.10.0
- Update of rootfile
- Changelog
2.10.0
keymaps:
Add Backtab keysym and update keymaps to use it for Shift+Tab.
Add keymap for Norwegian Apple ISO keyboard. )
Adjust Swiss German keyboard mappings.
libkeymap:
Add API to validate keysyms.
Add XKB-aware symbol aliases through the normal synonym tables.
Fix compose table upload limit handling.
utils:
loadkeys: Add support for generating console keymaps from XKB.
loadkeys: Add XKB compose import support.
loadkeys: Add support for XKB group switching, modifier handling,
virtual console switching and keypad/editing remaps.
loadkeys: Add diagnostics for XKB keysym coverage.
openvt: make -u process matching more conservative.
contrib:
Add an XKB keysym coverage diagnostic tool.
Add a VT layout indicator using keyboard LED lock triggers.
build:
Add a project-level coverage-report target.
Keep coverage flags and gcov runtime linking consistent.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Wed, 10 Jun 2026 19:01:55 +0000 (21:01 +0200)]
harfbuzz: Update to version 14.2.1
- Update from version 14.2.0 to 14.2.1
- Update of rootfile
- Changelog
14.2.1
- Various AAT shaping fixes: legacy `mort` contextual offsets (which could
produce out-of-font glyph IDs), in-place deleted-glyph replacements, and
overflow in obsolete offset math.
- Fix Arabic PUA fallback shaping for the isolated lam-alef-maksura ligature.
- Fix float-to-int overflow in `avar2` mapping with malformed fonts.
- Harden buffer verification after detecting non-monotone clusters.
- Various `COLR` v1 fixes: fix handling of `.notdef` without paint, round alpha
consistently, and report the root clip under the font transform.
- Various Glyph-extents fixes: inclusive rounding, and floating-point scaling
before rounding so the reported box always covers the glyph.
- Various Subsetting fixes: keep the `palt` spacing feature by default, raise
the repacker `MAX_SPACES` limit, fix a repacker crash on shared `LigatureSet`
nodes, guard `gvar` size overflow on 32-bit, and fix the `post` glyph-name
sort comparator on macOS.
- Replace `std::sort` with an internal quicksort, removing leaked `std::`
symbols from the `libharfbuzz` ABI.
- Harden size computations with saturating arithmetic against 32-bit overflow.
- Various improvements to the experimental Rust shaper (HarfRust) and font
functions (`fontations`): honor custom font funcs, key shape plans on
features, faster buffer handling, and update to HarfRust 0.8.
- Various fixes to the experimental `harfbuzz-gpu` and `harfbuzz-vector`
libraries, including a `harfbuzz-vector` heap buffer overflow and Windows
build fixes.
- Map the `Hrkt` (Katakana or Hiragana) script tag to the `kana` OpenType tag.
- Build configuration: new `HB_CONFIG_OVERRIDE_LAST_H` override header,
decouple `HB_NO_DRAW` from `HB_NO_CFF`, and an optional `hb-allocator` Cargo
feature.
- Various build, CI, and fuzzing fixes.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Wed, 10 Jun 2026 19:01:46 +0000 (21:01 +0200)]
alsa: Update to version 1.2.16
- Update alsa-lib from version 1.2.15.3 to 1.2.16
- Update alsa-ucm-conf from version 1.2.15.3 to 1.2.16
- Update alsa-utils from version 1.2.15.2 to 1.2.16
- Update of rootfile
- Changelog
1.2.15.3 to 1.2.16
alsa-lib
Core
Release v1.2.16
configure: update to autoconf v2.72
pcm: use new logging for hw_params dump, add pcm_params log interface
github: add pr-validation and label-automation workflows
Control API
Revert "snd_tlv_convert_to_dB: Fix mute handling for MINMAX_MUTE type"
control: remap - fix memory leak in remap_load_list()
control: remap - cosmetic code reorganization
control: remap - fix numid lookup issue
control: ctlparse - make numid parsing more robust
PCM API
pcm: fix leading space in snd_pcm_hw_param_dump for mask parameters
pcm: use new logging for hw_params dump, add pcm_params log interface
pcm: snd_pcm_slave_conf - fix C99 variable-length array allocation
RawMidi API
rawmidi: clarify no_active_sensing doc: output-only, does not filter input
Sequencer API
conf, seq, ucm: fix discards const from pointer target
Topology API
Topology: Add high and extended rates from Linux 6.12
topology: decoder: fix wrong sizeof for enum control allocation in dapm
topology: decoder - add boundary check for channel mixer count
Use Case Manager API
conf, seq, ucm: fix discards const from pointer target
ucm: add DefineRegex 'all' scheme for multiple pattern matches (Syntax 9)
ucm: fix optional include
ucm: add show_err parameter to uc_mgr_get_variable
ucm: find-card,find-device - add UCM variable support for arguments (Syntax 9)
ucm: add info-card substitution (Syntax 9)
ucm: evaluate Repeat block before If block (Syntax 9)
ucm: allow string with substitution for If.Condition block (Syntax 9)
ucm: optimize if_eval_string with common comparison helper
ucm: add Repeat block - repetitive pattern substitution (Syntax 9)
ucm: add integer comparison condition (Syntax 9)
ucm: substitute define IDs and macro arguments (Syntax 9)
ucm: fix invalid pointer dereference in parse_open_variables()
ucm: libconfig parser - fix pathname for substituted file
Configuration
conf, seq, ucm: fix discards const from pointer target
Error handler
error: use SND_LOG_LAST/SND_ILOG_LAST in log priority/interface bounds checks
pcm: use new logging for hw_params dump, add pcm_params log interface
alsa-ucm-conf
Core
github: workflow: fix paths for the last change
github: workflow: move things to separate alsa-project/github-workflows repo
github: workflow: another permissions fix - inherit
github: workflow: another permissions fix for pr-validation
github: workflow: another permissions fix (token)
github: workflow: try to set permissions explicitly
github: accept any Signed-off-by tag (case insensitive)
github: add GitHub label automation and SOB validation workflows
Configuration
sof-soundwire: rt711-sdca: add Headset Mic Switch to Headset sequences
sof-soundwire: rt711-sdca: set PGA30.0 volume in BootSequence
HDA: move speaker config to HiFi-spk.conf file
ucm2: Qualcomm: fix device ids for surface pro 12in
ucm2: MediaTek: mt8366-evk: Add alsa-ucm support
ucm2: Toradex: apalis-imx8: Set default values for input and output devices
ucm2: Toradex: apalis-imx8: Fix symlink name and path configuration
HDA/HiFi-analog.conf: skip Line2 ConflictingDevice when loctl is empty (Line1 not created)
USB-Audio: ALC4080: Add support for ASUS Pro ET900N G3 - Station GB300 platform
ucm2: sof-soundwire: add Mic LED control for ACP PDM DMIC
ucm2: sof-soundwire: add combined cs42l43-spk+cs35l56 config
ucm2: sof-soundwire: cs42l43: Separate init handling of speaker and headset
ucm2: rt722: add speaker mute LED and PlaybackSwitch for FU06
ucm2: Qualcomm: Add HONOR MagicBook Art 14 support
ucm2: Qualcomm: x1e80100: T14s-HiFi: remove duplicate DP Jack names
ucm2: Qualcomm: x1e80100: T14s-HiFi: switch DP outputs to dedicated MultiMedia5/6/7 streams
ucm2: Qualcomm: Enable Headset Microphone on kaanapali-mtp
ucm2: Qualcomm: Enable Headset Microphone on sm8750-mtp
ucm2: add Arduino monza support
ucm2: Qualcomm: Rename qcm6490-idp ucm2 conf
ucm2: Qualcomm: Fix headphone mic mute setting on qcm6490-idp
ucm2: Add config for Tascam US-2x2HR
sof-soundwire: add rt722 into hs_init
sof-soundwire: rt1320: add rt1320 dmic config
sof-soundwire: rt1320: add playback control switch
sof-soundwire: add companion amp config with rt721 and rt1320
tegra-hda: Add HDMI/DP outputs 2-4 for Tegra186+
ucm2: conf.d: fix h616-audio-codec symlink
ucm2: conf.d: fix QCS6490-RB3Gen2 symlink
ucm2: conf.d: fix qcm6490-idp-snd-card symlink
ucm2: conf.d: fix Kaanapali-MTP.conf symlink
ucm2: Qualcomm: Create missing symlink for Radxa Dragon Q6A
ucm2: sof-soundwire: cs42l43: support UAJ-less configuration
ucm2: Focusrite Scarlett 18i20 Gen 1 — fix USB ID regex (1235:800c)
USB-Audio: fixes for M-Audio Fast Track Ultra
USB-Audio: Add Audient EVO4
Add UCM2 configuration for M-Audio Fast Track Ultra
ucm2: Qualcomm: add QCS6490 Thundercomm RubikPi3 HiFi config
sof-hda-dsp: add workaround for speaker LED on MSI laptops
ucm2: sof-soundwire: Add support for CS42L43B variant
ucm2: tegra: wm8903: fix headphones conflicting device
ucm2: sof-soundwire: Add support for Cirrus Logic CS47L47
Qualcomm: glymur: Add GLYMUR CRD HiFi config
ucm2: Qualcomm: add ASUS Vivobook 14 (X1407QA) to x1e80100 DMI match
Add multitrack mappings for 1.7.3 firmware
ucm2: da7213: Fix mic capture in HeadphoneMic2 use case
USB-Audio: Scarlett 18i20 fix ADAT capture channel count for Gen 1/2
ucm2: sof-soundwire: add ACP DMIC configuration
USB-Audio: ALC4080 add USBID 0db0:82c4 (MSI MEG Z790 Godlike Max)
USB-Audio: ALC4080 add USB ID 0db0:95bb (MSI MEG Z690 Unify)
USB-Audio: Add RODECaster Pro II
ucm2: codecs: lpass-wsa-macro: disable WSA_COMP
ucm2: codecs: lpass-rx-macro: disable RX_COMP
ucm2: codecs: wcd938x: add enable sequence with CLS_AB_LOHIFI for laptops
ucm2: codecs: wcd939x: Use CLS_H_LOHIFI instead of CLS_H_ULP by default
ucm2: codecs: wcd938x: Use CLS_H_LOHIFI instead of CLS_H_ULP by default
ucm2: codecs: wcd937x: Use CLS_H_LOHIFI instead of CLS_H_ULP by default
ucm2: codecs: wcd934x: Use CLS_H_LOHIFI instead of CLS_H_ULP by default
ucm2: Qualcomm: qcs8300: Remove Fixed channel setting for monaco-evk
ucm2: Qualcomm: sa8775p: Remove Fixed channel setting for lemans-evk
Qualcomm: qcs615: Remove JackControl from TALOS EVK HiFi config
USB-Audio: Motu: M6-HiFi.conf - m6 has only 4 outputs, not 6
common: split.conf - simplify macro call arguments
common: split.conf - put macro arguments to one string
USB-Audio: ALC4080 add USB ID 0db0:19a2 (MSI MAG B850 Tomahawk Wifi)
USB-Audio: correct typo in Universal Audio Volt 2 config
USB-Audio: cosmetic change for Flow8
USB-Audio: use macros in the base file
USB-Audio: ALC4080 add USB ID 0db0:d4fa (MSI MPG B850I Edge TI Wifi)
USB-Audio: optimize ProfileName assignments
USB-Audio: merge configs for Solid State Labs SSL 2 (normal + plus + MK II)
USB-Audio: ALC4080 - fix Speaker PCM device name
USB-Audio: ALC4080 - fix 'detect S/PDIF device using find-pcm'
USB-Audio: Fix - ALC4080 add USB ID 0b05:1a7a (ASUS ROG Strix X670E-I Gaming WiFi)
USB-Audio: ALC4080 - detect S/PDIF device using find-pcm
USB-Audio: ALC4080 - add Headset device
USB-Audio: ALC4080 - use PCM device indexes rather than full names in variables
USB-Audio: ALC4080 add USB ID 0b05:1a7a (ASUS ROG Strix X670E-I Gaming WiFi)
USB-Audio: ALC4080 - add list of known Jack controls to comment
USB-Audio: ALC4080 add USB ID 0db0:4c84 (MSI MPG X870I EDGE TI EVO WIFI)
USB-Audio: Add Focusrite Vocaster interfaces
Add support for the Behringer ULM200D wireless microphones.
ucm2: da7213: Add ADC switch in HeadphoneMic2 sequences
USB-Audio: Add support for the SSL 2 MK II and SSL2+ MK II
USB-Audio: improve channel detection for Solid State Labs SSL 2
USB-Audio: Dualsense PS5 - add direct use case
USB-Audio: ALC4080 add USB ID 0b05:19ac (ASUS ROG Maximus Z490/Z590 XIII Hero)
ucm2: Qualcomm: add Asus Vivobook 16 support
ucm2: Qualcomm: Add Lenovo Yoga Air 14s support
ucm2: Qualcomm: add Dell XPS 9345
ucm2: Qualcomm: document existing hardware
1.2.15.2 to 1.2.16
alsa-utils
Core
Release v1.2.16
INSTALL: update compilation from git sources
configure: update to autoconf v2.72
ALSA Control (alsactl)
aplay, alsactl, topology: fix discards const from pointer target
Remove more generated files on "make clean"
Speaker Test
speaker-test: extend MAX_CHANNELS from 16 to 32
speaker-test: fix segfault with more than 16 channels
aconnect
aconnect: fix error handler for alsa-lib <= 1.2.15
alsa-info.sh
alsa-info.sh: remove some bashisms to allow run with busybox
alsaloop
alsaloop: parse_config(): align optstring order with the long options
alsaloop: parse_config(): handle long form --wake option
alsaloop: parse_config(): drop unused 'F' option
alsaloop: parse_config(): handle short form -B / -E options
alsatplg (topology)
aplay, alsactl, topology: fix discards const from pointer target
amixer
amixer: always use line buffering for (s)events
amixer: document --file option in man page
amixer: support --file option
amixer: support infinite line length for --stdin option
aplay/arecord
aplay, alsactl, topology: fix discards const from pointer target
Remove more generated files on "make clean"
aplay: use snprintf instead of sprintf in device_list()
gitcompile
gitcompile: extensions for gettext and error handling
configure: update to autoconf v2.72
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Wed, 10 Jun 2026 19:01:47 +0000 (21:01 +0200)]
bash: Update to version 5.3 patch 15
- Update from version 5.3 patch 9 to 5.3 patch 15
- No change in rootfile
- Changelog
patch 10
Under some circumstances, a subshell or asynchronous job with an active
EXIT trap that contains a call to `wait' can loop trying to wait for
processes that are not its children. It usually inherits these jobs from
its parent in the jobs list.
patch 11
If a `mapfile' callback unsets the array variable `mapfile' is using to save
the lines it reads, `mapfile' can try to reference freed memory, which can
cause corruption or shell crashes.
patch 12
If a subshell with an inherited EXIT trap receives a fatal signal before
it clears the exit trap, and before it restores its original signal
handlers, it's possible for it to inappropriately run the inherited EXIT
trap.
patch 13
Comparing the value of a pointer returned from realloc/xrealloc to the
original pointer passed is technically undefined behavior, which matters
under some circumstances.
patch 14
Bash-5.3 patch 11 included an inadvertent extra line, which this patch
removes. This also takes the opportunity to improve that patch, by looking
up the variable each time through the line-reading loop only if there is
a callback and it is invoked.
patch 15
There are circumstances under which index -1 is used to reference into
the input buffer used by the `read' builtin.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
For details see:
https://download.samba.org/pub/rsync/NEWS#3.4.4
"NEWS for rsync 3.4.4 (8 Jun 2026)
Changes in this version:
This is a conservative point release that backports regression fixes on top
of 3.4.3. No new features are included.
BUG FIXES:
Honour a relative alt-basis directory (e.g. --link-dest=../sibling,
--copy-dest, --compare-dest) on a daemon receiver running with use
chroot = no. Such a path is re-anchored at the module root but was then
rejected by the receiver's secure open; it now works where
kernel-enforced confinement is available. See the PORTABILITY note
below for the platform limitation. Fixes #915.
sender: open a module-root-absolute path for a path = / module so a
daemon serving the filesystem root can satisfy absolute request paths
again. Fixes #897.
flist: accept the missing-args mode-0 entry in recv_file_entry. Fixes
#910.
receiver: fix a false "failed verification -- update discarded" when
resuming a delta transfer with an absolute --partial-dir.
receiver: fix a NULL dereference on the delta discard path.
generator: cap the block s2length at the negotiated checksum length.
main: fix --mkpath with --dry-run for a file-to-file copy. Fixes #880.
token: drain the matched-block insert deflate. Fixes #951.
Fix the "update skips a file of a different type" case and the daemon
upload delete stats.
alloc: revert "zero all new memory from allocations". Fixes #959.
Always clear the stat buffer and validate nanoseconds before use.
PORTABILITY / BUILD:
The relative alt-basis fix for daemon receivers (#915) relies on kernel
"stay below dirfd" path resolution -- openat2(RESOLVE_BENEATH) on
Linux 5.6+, or openat() with O_RESOLVE_BENEATH on FreeBSD 13+ and macOS
15+. On platforms that lack it (Solaris, OpenBSD, NetBSD, Cygwin and
older Linux) secure_relative_open() deliberately rejects any path with
a .. component, so relative alt-basis directories remain unavailable
there -- function traded for safety, matching the trade-off already
documented for the #715 fix. Absolute alt-basis paths are unaffected on
every platform.
openat2 is now autodetected at configure time (HAVE_OPENAT2): the
openat2(RESOLVE_BENEATH) resolver is compiled in only when both
<linux/openat2.h> and the SYS_openat2 syscall number are present,
fixing the build on older kernels/headers. Fixes #924, #905, #900,
#904.
Fall back to do_mknod() when mknodat() / mkfifoat() are unavailable.
Fixes #896.
Install generated manpages correctly in an out-of-tree build.
DEVELOPER RELATED:
Added a CI workflow that builds this stable branch and runs the
v34-stable-testsuite regression suite against the built binary, giving
regression coverage without importing the full master test suite into
the stable branch.
Added a check-progs target for fleettest and extended the build
workflows to run on *-stable release branches."
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
For details see:
https://dlcdn.apache.org/httpd/CHANGES_2.4.68
"Changes with Apache 2.4.68
*) SECURITY: CVE-2026-49975: mod_http2 denial of service
(cve.mitre.org)
Memory Allocation with Excessive Size Value vulnerability in
Apache HTTP Server's mod_http leads to denial of service via
malicious HTTP requests.
This issue affects Apache HTTP Server: from 2.4.17 through
2.4.67.
Credits: Quang Luong of Calif.IO in collaboration with OpenAI
Codex
*) SECURITY: CVE-2026-48913: mod_http2 memory corruption when file
handles exhausted (cve.mitre.org)
Use After Free vulnerability in Apache HTTP Server module
mod_http2 when file handles are already exhausted.
This issue affects Apache HTTP Server: from 2.4.55 through
2.4.67.
Credits: Sam Lovejoy, IBM X-Force Offensive Research (XOR)
*) SECURITY: CVE-2026-44631: Heap Underflow in `ap_regname` via
Signed Char Overflow (cve.mitre.org)
Buffer Underwrite vulnerability in Apache HTTP Server on crafted
regular expressions in the configuration.
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
Users are recommended to upgrade to version 2.4.68, which fixes
the issue.
Credits: Zhenpeng (Leo) Lin at depthfirst
*) SECURITY: CVE-2026-44186: Loop in `proxy_ftp_handler` in
mod_proxy_ftp (cve.mitre.org)
Loop with Unreachable Exit Condition ('Infinite Loop')
vulnerability in the mod_proxy_ftp module in Apache HTTP Server
with an attacker controlled backend FTP server.
This issue affects undefined: from 2.4.0 through 2.4.67.
Users are recommended to upgrade to version 2.4.68, which fixes
the issue.
Credits: Zhenpeng (Leo) Lin at depthfirst
*) SECURITY: CVE-2026-44185: Stack Buffer Over-Read in mod_ssl OCSP
`send_request` (cve.mitre.org)
Buffer Over-read vulnerability in Apache HTTP Server via
outbound OCSP requests to an attacker controlled OCSP server
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
Users are recommended to upgrade to version 2.4.68, which fixes
the issue.
Credits: Zhenpeng (Leo) Lin at depthfirst
*) SECURITY: CVE-2026-44119: escalation of privilege through
expressions in .htaccess in multiple modules (cve.mitre.org)
Improper Privilege Management vulnerability in Apache HTTP
Server 2.4.67 and earlier allows local .htaccess authors to read
files with the privileges of the httpd user.
This issue affects Apache HTTP Server: from through 2.4.67.
Users are recommended to upgrade to version 2.4.68, which fixes
the issue.
Credits: Lucian Nitescu
*) SECURITY: CVE-2026-43951: OOB Read in `merge_response_headers`
can cause crash (cve.mitre.org)
Out-of-bounds Read vulnerability in Apache HTTP Server with
mod_headers and mod_mime and multiple response languages.
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
Credits: Zhenpeng (Leo) Lin at depthfirst
*) SECURITY: CVE-2026-42536: mod_xml2enc heap overflow
(cve.mitre.org)
Heap-based Buffer Overflow vulnerability in Apache HTTP Server
with mod_xml2enc, xml2StartParse, and untrusted content
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
Users are recommended to upgrade to version 2.4.68, which fixes
the issue.
Credits: Zhenpeng (Leo) Lin at depthfirst
*) SECURITY: CVE-2026-42535: mod_dav_fs protected directory access
(cve.mitre.org)
A path handling issue in mod_dav_fs in Apache 2.4.67 and
earlier allows a WebDAV content author to directly manipulate
trusted DAV property databases, potentially causing child
process crashes.
Users are recommended to upgrade to version 2.4.68, which fixes
this issue.
Credits: Zhenpeng (Leo) Lin at depthfirst
*) SECURITY: CVE-2026-34356: ProxyPassReverseCookieMap buffer
overflow (cve.mitre.org)
Heap-based Buffer Overflow vulnerability in Apache HTTP Server
with malicious backend servers and ProxyPassReverseCookie*
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
Users are recommended to upgrade to version 2.4.68, which fixes
the issue.
Credits: Arkadi Vainbrand
*) SECURITY: CVE-2026-34355: mod_proxy_html buffer overflow
(cve.mitre.org)
A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67
and earlier allows an attack by an untrusted backend.
Users are recommended to upgrade to version 2.4.68, which fixes
this issue.
Credits: Elhanan Haenel
*) SECURITY: CVE-2026-29170: mod_proxy_ftp XSS (cve.mitre.org)
A cross-site scripting vulnerability exists in mod_proxy_ftp's
HTML directory list generation in Apache HTTP Server 2.4.67 and
earlier when listing FTP directory contents either via forward
or reverse proxy configuration.
Users are recommended to upgrade to version 2.4.68, which fixes
this issue.
Credits: Pavel Kohout, Aisle Research, Aisle.com
*) SECURITY: CVE-2026-29167: mod_ldap per-dir use-after-free
(cve.mitre.org)
Use After Free vulnerability in Apache HTTP Server with mod_ldap
in per-directory configuration
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
Users are recommended to upgrade to version 2.4.68, which fixes
the issue.
Credits: Pavel Kohout, Aisle Research, Aisle.com
*) mod_ssl, ab: Add support for OpenSSL 4.0. [Joe Orton]
*) mod_ssl: Add SerialNumber as a recognized attribute type for SSL
distinguished name variables. [Michael Osipov <michaelo apache.org>,
Benjamin Demarteau <benjamin.demarteau liege.be>]
*) mod_ssl: Set auth type to "ClientCert" when client certificate authentication
has been performed. [Michael Osipov <michaelo apache.org>]
*) mod_include: Don't print any of if/elsif/else content when
a conditional evaluation returns an error. [Eric Covener]
*) mod_file_cache: Fix crashes for mmap'ed files under threaded
MPMs. PR 69901. barr.israel <barr.israel campus.technion.ac.il>
*) core: Add support for %{m}t in ErrorLogFormat to log milli-second
time resolution (in addition to existing %{u}t for micro-seconds).
[Luboš Uhliarik <luhliari redhat.com>]
*) mod_unixd: Drop test that effective user ID is zero in
a chroot configuration. PR 69767.
[Bastien Roucaries <rouca debian.org>]
*) mod_proxy_balancer: Include nonce in XML output. PR 63074.
Federico Mennite <federico.mennite lifeware.ch>
*) mod_http2: update to version 2.0.42
Fix excessive file description use for non-TLS frontend connections when
sending files. Fixes <https://github.com/icing/mod_h2/issues/325>
[Stefan Eissing]
*) mod_http2: update to version 2.0.41
Fix cookie header accounting against LimitRequestFields.
[Stefan Eissing]
*) mod_http2: update to version 2.0.40
Fix error handling on upload requests when server runs out of file
handles that left beam bucket callbacks in place, potentially using
no longer valid references. Only applies on platforms with pipes
and file descriptor limits not healthy for a network server.
[Stefan Eissing]
*) mod_dav_fs: Return a 404 for DELETE if deletion fails because the
resource no longer exists. PR 60746. [Joe Orton]
*) mod_proxy_hcheck: Fix healthcheck disabled due to child restart while
updating. [Yann Ylavic]"
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
For details see:
https://download.samba.org/pub/rsync/NEWS#3.4.4
"NEWS for rsync 3.4.4 (8 Jun 2026)
Changes in this version:
This is a conservative point release that backports regression fixes on top
of 3.4.3. No new features are included.
BUG FIXES:
Honour a relative alt-basis directory (e.g. --link-dest=../sibling,
--copy-dest, --compare-dest) on a daemon receiver running with use
chroot = no. Such a path is re-anchored at the module root but was then
rejected by the receiver's secure open; it now works where
kernel-enforced confinement is available. See the PORTABILITY note
below for the platform limitation. Fixes #915.
sender: open a module-root-absolute path for a path = / module so a
daemon serving the filesystem root can satisfy absolute request paths
again. Fixes #897.
flist: accept the missing-args mode-0 entry in recv_file_entry. Fixes
#910.
receiver: fix a false "failed verification -- update discarded" when
resuming a delta transfer with an absolute --partial-dir.
receiver: fix a NULL dereference on the delta discard path.
generator: cap the block s2length at the negotiated checksum length.
main: fix --mkpath with --dry-run for a file-to-file copy. Fixes #880.
token: drain the matched-block insert deflate. Fixes #951.
Fix the "update skips a file of a different type" case and the daemon
upload delete stats.
alloc: revert "zero all new memory from allocations". Fixes #959.
Always clear the stat buffer and validate nanoseconds before use.
PORTABILITY / BUILD:
The relative alt-basis fix for daemon receivers (#915) relies on kernel
"stay below dirfd" path resolution -- openat2(RESOLVE_BENEATH) on
Linux 5.6+, or openat() with O_RESOLVE_BENEATH on FreeBSD 13+ and macOS
15+. On platforms that lack it (Solaris, OpenBSD, NetBSD, Cygwin and
older Linux) secure_relative_open() deliberately rejects any path with
a .. component, so relative alt-basis directories remain unavailable
there -- function traded for safety, matching the trade-off already
documented for the #715 fix. Absolute alt-basis paths are unaffected on
every platform.
openat2 is now autodetected at configure time (HAVE_OPENAT2): the
openat2(RESOLVE_BENEATH) resolver is compiled in only when both
<linux/openat2.h> and the SYS_openat2 syscall number are present,
fixing the build on older kernels/headers. Fixes #924, #905, #900,
#904.
Fall back to do_mknod() when mknodat() / mkfifoat() are unavailable.
Fixes #896.
Install generated manpages correctly in an out-of-tree build.
DEVELOPER RELATED:
Added a CI workflow that builds this stable branch and runs the
v34-stable-testsuite regression suite against the built binary, giving
regression coverage without importing the full master test suite into
the stable branch.
Added a check-progs target for fleettest and extended the build
workflows to run on *-stable release branches."
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Tue, 9 Jun 2026 18:37:01 +0000 (18:37 +0000)]
make.sh: Remove the timer
This seems to trigger a bug bash which causes the build process to hand
for forever. Since most packages build fast enough, we will simply
remove it and only print the total build time.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Tue, 9 Jun 2026 14:43:22 +0000 (16:43 +0200)]
wio.cgi: Change status extraction due to OpenVPN-2.7 change
- With OpenVPN-2.7 the format of the RW status log changed. This was updated in
the ovpnmain.cgi file but was missed for the wio.cgi file
- This patch corrects that.
Tested-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Mon, 8 Jun 2026 13:58:21 +0000 (13:58 +0000)]
strongswan: Update to 6.0.7
CVE-2026-47895 - Fixed a vulnerability in libstrongswan related to the cloning of certain identities that can result in an double-free and potentially remote code execution. Affects 4.3.3 and newer.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Mon, 8 Jun 2026 09:31:37 +0000 (09:31 +0000)]
boost: Build the multi-threaded version only
We don't have any requirements for the single-threaded version (any
more?) and so to save space and make this all a lot easier to manage we
will only build the multi-threaded version.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Robin Roevens [Fri, 5 Jun 2026 21:28:30 +0000 (23:28 +0200)]
zabbix_agentd: Fix gateway ping errorhandling
Fixed gateway ping items:
* ipfire.net.gateway.pingtime: now always returns 0 when fping does not return the expected stats
* ipfire.net.gateway.ping: prevent possible stderr messages from slipping in the output
* ipfire.net.gateway.arpingtime: now always return 0 when arping does not return the expected stats.
* ipfire.net.gateway.arping: now effectively returns 0 when arping fails. Previously this returned the arping error making Zabbix fail to detect gateway down events.
Signed-off-by: Robin Roevens <robin.roevens@disroot.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Fri, 5 Jun 2026 16:40:20 +0000 (18:40 +0200)]
backup.pl: unbound entries not needed with knot in place
- With the change from unbound to knot the unbound specific user and group no longer
need to be created and any restored /etc/unbound directory can also be removed
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Fri, 5 Jun 2026 16:40:19 +0000 (18:40 +0200)]
backup.pl: Fix issue with University of Toulouse change
- Some months ago University of Toulouse changed any lists with a different French and
English name from being duplicate files to being a file plus a symlink.
- Doing a restore from a backup with symlinks into a system with only file names
resulted in a symlink trying to be created when a file with the same name already
existed causing a failure.
- This failure stopped the restore part way through resulting in only a partial restore.
- This patch removes all entries in the urlfilter blacklists, allowing all restored
entries to be created.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Fri, 5 Jun 2026 16:11:39 +0000 (18:11 +0200)]
which: Update to version 2.25
- Update from version 2.23 to 2.25
- No change to rootfile
- Changelog
2.25
* The changes of 2.22 and 2.23 were not in 2.24 because accidently used an old
repository.
2.24
* Bug fix for an out of bounds stack read (by Daniel Anderson)
Not exploitable as far as I can tell- so low priority.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Fri, 5 Jun 2026 16:11:37 +0000 (18:11 +0200)]
spice-protocol: Update to version 0.14.5
- Update from version 0.14.3 to 0.14.5
- No change to rootfile
- Changelog
0.14.5
* Add SPICE_MSG_DISPLAY_GL_SCANOUT2_UNIX
* Fix for Windows Arm64 build
0.14.4
* Fix enum deprecation warning for visual studio
* Fix documentation typos in stream-device.h
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Fri, 5 Jun 2026 16:11:38 +0000 (18:11 +0200)]
spice: Update to version 0.16.0
- Update from version 0.15.0 to 0.16.0
- Update of rootfile
- Changelog
0.16.0
Added
* Added DMA-BUF encoder support for GStreamer 1.24+
* Implemented hardware-accelerated encoding for Intel GPUs
* Added environment variable `SPICE_CONVERTER_PREFERRED_FORMAT` to override converter
format
* Multi-plane GL scanout support (new `spice_qxl_gl_scanout2()`)
Changed
* Improved memslot to preserve address bits for ARM64 TBI/AMD UAI/Intel LAM
* Optimized BGR24/BGRX32 conversion when `JCS_EXTENSIONS` is defined
* Removed GStreamer 0.10 support
* Send real time to client, instead of synchronizing on both ends, attempting to fix
latency issue
Fixes
* Fixes a `GL_DRAW` cookie assertion race
* Add `SSL_OP_NO_RENEGOTIATION` fallback path, fixing w/LibreSSL 3.7.2 builds
* Fix Win32 builds
* Fix `TCP_NOPUSH` usage on Darwin
0.15.2
Fixes
* Add missing file to distribution
* Fix sound recording fix in case of buffer wrapping
0.15.1
Fixes
* Fix some compatibility issues with FreeBSD
* Fix some minor issue with build
* Improve packaging with Meson
* Lot of C++ improves (clang-tidy)
* Fix some compatibility with no-Glibc libraries (like Musl)
* Fix minor leaks shutting down library
* Add Doxygen file to distribution
* Fix a longstanding issue related to surface updates where wrong surfaces were
possibly used
* Fix compatibility with OpenSSL 3
* Updates and fixes for CI
* Use more random connection IDs to fix possible issues with proxies
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Fri, 5 Jun 2026 16:11:36 +0000 (18:11 +0200)]
ntfs-3gt: Update to version 2026.2.25
- Update from version 2022.10.3 to 2026.2.25
- No change to rootfile
- One CVE fix
- Changelog
2026.2.25
Fix bashism in configure script causing errors in non-bash shells.
(mkntfs) Enable microsecond-level volume creation time.
Fix two instances of an invalid errno state when encountering NULL in strings.
Fix a crash when a reparse tag could not be found in the index.
Fix incorrect MFT free records value when bitmap is expanded.
Fix 'extras' manpages being installed when extras are disabled.
Fix various instances of use-after-free conditions in the library and tools.
Fix typo in NTFS hibernation message. Thanks to Anil Kumar for the report/fix.
Escape commas in the fsname when libfuse 2.8 or higher is used.
(ntfsclone) Allow adjusting the sector size in the NTFS boot sector for the target
device when restoring images.
Remove libdl dependency when building without external plugins.
(ntfsinfo) Show information about the logfile state when dumping metadata.
(ntfsinfo) Fix displaying crowded directories or indexes.
(ntfsinfo) Fix displaying the security descriptor list in ntfsinfo.
Fix heap buffer overflow when POSIX ACLs were enabled (CVE-2026-40706). Thanks to
Andrea Bocchetti for the report.
(ntfsusermap) Fix overflow when constructing backup filename.
Fix two time-of-check-time-of-use conditions.
Fix missing malloc/sscanf return value checks.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Fri, 5 Jun 2026 16:11:35 +0000 (18:11 +0200)]
less: Update to version 702
- Update from versionj 692 to 702
- Update of rootfile
- Changelog
702
* Add --hilite-target option and -DJ to color target line (github #745).
* Add --past-eof option.
* Add --end-prompt option.
* Add --emouse and --rmouse options, and horizontal mouse scrolling
and dragging (github #744).
* Add -DT option to format tilde lines (github #725).
* Change OSC 8 link handling: replace LESS_OSC8_xxx with LESS_OSC8_OPEN_xxx.
Remove %O from prompt expansion as no longer needed.
Any use of environment variables LESS_OSC8_xxx need to be manually
changed to use LESS_OSC8_OPEN_xxx.
* Add ?o to prompt strings, to detect whether an OSC 8 link is selected.
* When scrolling past end-of-file or before beginning-of-file,
stop when exactly one line is left on screen.
* Make -w/-W highlight lines when moving backward as well as forward
(github #729).
* Display pattern in "Pattern not found" message (github #731).
* Allow m and M commands to take a numeric argument to specify the
line to be marked (github #736).
* Allow ' command to take a numeric argument to specify the screen
position on which to place the marked line.
* Allow lesskey to map keypad ENTER with \kpe (github #761).
* Add "noaction" as a possible action in #line-edit section
in a lesskey file (github #761).
* Support POSIX character classes with the built-in V8 regex library
(github #732).
* Change | command to pipe just one line if the marked line is at the
top of the screen (github #733).
* If OSC8 handler command begins with "-", suppress command echo,
and if it begins with ctrl-P, suppress "done" message (github #747).
* Don't ask for confirmation when input is a binary file and stdout is
redirected. Fixes infinite loop in that situation (github #719).
* Make early error messages go to stderr if stdout is redirected
(github #719).
* Don't retry read after read error; fixes hang when attempting to read
a directory or other unreadable file (github #741).
* Fix incorrect restoration of saved mark if not at top of screen.
* With --save-marks, don't save a mark that was cleared with ESC-m.
* Fix buffer overflow when using malformed lesskey file (github #721).
* Fix unexpected scrolling past end of file (github #720).
* Fix bug when env var in LESSKEY_CONTENT partially matches env var
defined in lesskey file (github #727).
* Fix bug when env var in lesskey file matches tail of env var used
by less (github #728).
* Fix command parsing bug when one command is a substring of another.
Also fixes --no-paste option (github #724).
* Fix incorrect display using --color to set character attributes
without color, such as -DS-u (github #730).
* Fix crash when tags file contains invalid line number 0 (github #743).
* Fix build when tparm() doesn't use varargs (github #748).
* Fix prompt overflow when filtering with long prompt (github #749).
* Fix incorrect highlighting when change -i while filtering (github #750).
* Fix erroneous error mesage using --show-preproc-error with
some shells (github #753).
* Fix erroneous highlighting when using a search pattern containing more
than 5 pairs of parentheses with PCRE2 (github #754).
* When ^X interrupts F mode, discard pending keys as is done when
^C interrupts it (github #757).
* Fix bug in Windows where pressing any key during "waiting for data" would
prevent a subsequent ^X from working.
* Fix erroneous display in some situations when using LESS_LINES (github #759).
* Fix erroneous display after certain messages are displayed in a
very narrow terminal (github #760).
* Don't init terminal if stdout is not a tty (github #768).
* Fix bug clicking OSC 8 link that crosses a screen line boundary
(github #775).
* Fix beeps when resizing window on Windows (github #771).
* Fix beeps when paging continuously on Windows (github #772).
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Fri, 5 Jun 2026 16:11:34 +0000 (18:11 +0200)]
fontconfig: Update to version 2.18.1
- Update from version 2.17.1 to 2.18.1
- Update of rootfile
- Changelog
2.18.1
ci: Fix wrong short options for glab
Fix not matching with a font family name
test-conf: Add a feature to load a certain config for testing
test: Add comprehensive documentation for test-conf JSON format
Fix another font matching issue
Do not set 'sans-serif' for default genericfamily
test: use const instead of number for genericfamily
meson: force enabling HAVE_C99_VSNPRINTF
Disable invalid attribute warning by default
ci: Add .abidiff for suppression
Workaround :-prefixed filename used in Qt
meson: Only install 05-macos.conf on darwin
Fix a null pointer dereference when computing a pattern from an FT_Face that
has no family
2.18
ci: Add Fedora 42 and drop 40
ci: Add FreeBSD 14.2 and drop 14.1
ci: Update ci-tamplates
ci: Add Alpine Linux
ci: Fix a typo
ci: make sure build.sh is running on bash
ci: Use venv to avoid externally-managed-environment error on Alpine
ci: Add extra setup hook
ci: install test fonts for Alpine
test: Fix a build issue with musl libc
fc-lang: Add suz.orth for Sunuwar
test: add common helper class
test: port basic functionality check to Python
test: update to pass test cases on Win32
do not mix up a slash and a backslash in file object on Win32
meson: Add a missing fontconfig architecture test case
Add fontconfig version in FcCache
Improve a warning message
Better error message when missing default config
ci: install before test to avoid fontconfig error
Fix regex to pick up libtool version
Improve performance in FcConfigAdd
Improve log header in FcConfigSubstituteWithPat
meson: Update WrapDB files for v2 format migration
ci: add an option for the address sanitizer
Fix "UBSAN null pointer passed" to qsort
ci: Enable ASAN and UBSAN
Add genericfamily object in FcPattern
Add xsi:nil attribute support to limited elements
Get out from FcConfigAdd immediately if no valid pointer given
Bump the cache version again
fc-case: Update CaseFolding.txt to Unicode 17
ci: Update git repo for subproject build
ci: Add a test case for static build on Win32
Add obvious namespace to macros for FC_SPACING
Improve handling of constant name
test: fix pytest error when running on the top project directory
meson: Update wrapdb for expat to the latest
Use FcStrCopy instead of strdup
Fix -Wpointer-sign warnings
Do not store duplicate object name into FcObjectSet
Fix unused variable warning when iconv support disabled
doc: Fix a typo in FcPatternAdd description
Add fc-genconf the configuration generator tool
test-conf: Correct test results to display at the proper place
Fix unexpected priority change when looking up by specific family name
Return error code if FcPatternFormat failed
Add const converter for pattern format
fc-genconf: Add scan pattern to update genericfamily with commandline option
Fix dereferencing a null pointer of FcConfig in FcFontSetSort
conf.d: Fix a typo in 65-khmer.conf
Update doc for xsi:nil attribute support
test: add more conditional for bwrap sandbox test cases
meson: add tests-bwrap option
Avoid locale-dependent float-to-string
ci: enable json-c for MinGW
test-conf: add wrapper setenv for Win32
ci: Use 14.3 CI image for FreeBSD
Fix invalid memory access on Win32
More fixes for locale-dependent float-to-string conversion
Replace strtod() with FcStrtod()
ci: Fix warnings from shellcheck
ci: workaround for the ownership change issue on extracting tar
ci: Fix a typo
ci: simplify scriptlet
ci: Hold the version of meson at 1.10.1 temporarily
ci: Enable the debugging build by default
ci: Do not store the build log at the source dir
Explicitly declare FcPatternObjectCount as a public function
ci: Add API/ABI checker in CI
ci: Fix 'refusing to fetch into branch' error
Update meson dependency to 1.11.0
ci: Update Fedora Image to 44 and 43
ci: Disable pipelines for macOS and VS on Windows
Revert "ci: Disable pipelines for macOS and VS on Windows"
ci: Replace shell scripts with portable Python build system
ci: Add MSYS2 build pipeline
ci: Use CI_PROJECT_DIR instead of hardcode path
ci: fix argument error in abicheck.sh
Define __EXTENSIONS__ on illumos/Solaris to access strdup()
Update default Korean fonts
Remove unused global variable default_langs
Fix rustc warning for mismatching referred lifetimes
[Fontations] Fix use-after-free in handling exclusive lang
Fix memory leak after path canonicalization in e42188283f0ee
[Fontations] Remaining fix for UaF
Architecture-dependent hex formatting of int64_t in fccache.c
[Fontations] Don't leak PatternElement values
Roll Fontations Crates
[Fontations] Match FreeType for two types of broken fonts
[Fontations] Fix compilation under -D unsafe-op-in-unsafe-fn
Move FreeType-related API to fcfreetype.h header
Minimal preparations for FreeType-less build
Follow-up for preparation for FreeType-less build
Roll Fontations and libc crates
Update Mac OS image to upstream gStreamer image
Roll Fontations crates
build: Added missing target rule-dependencies
Use uintptr_t to represent pointers
macOS: use selectfont globs for font asset directories
meson: Don't dllexport when built as static library on Win32
Do not cast as const as the variable is being modified
detect mkostemp with stdlib.h
doc: Fix two typos
Fix -Wnewline-eof warning with fcconst.h
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
projects / ipfire-2.x.git / log
