[PATCH] core204: Ship elinks

[PATCH] core204: Ship elinks

[Adolf Belka]

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 config/rootfiles/core/204/filelists/elinks | 1 +
 1 file changed, 1 insertion(+)
 create mode 120000 config/rootfiles/core/204/filelists/elinks

diff --git a/config/rootfiles/core/204/filelists/elinks b/config/rootfiles/core/204/filelists/elinks
new file mode 120000
index 000000000..10db4dd8f
--- /dev/null
+++ b/config/rootfiles/core/204/filelists/elinks
@@ -0,0 +1 @@
+../../../common/elinks
\ No newline at end of file
-- 
2.54.0

[PATCH] core204: Ship expat

[Adolf Belka]

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 config/rootfiles/core/204/filelists/expat | 1 +
 1 file changed, 1 insertion(+)
 create mode 120000 config/rootfiles/core/204/filelists/expat

diff --git a/config/rootfiles/core/204/filelists/expat b/config/rootfiles/core/204/filelists/expat
new file mode 120000
index 000000000..e1923cf63
--- /dev/null
+++ b/config/rootfiles/core/204/filelists/expat
@@ -0,0 +1 @@
+../../../common/expat
\ No newline at end of file
-- 
2.54.0

[PATCH] core204: Ship file

[Adolf Belka]

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 config/rootfiles/core/204/filelists/file | 1 +
 1 file changed, 1 insertion(+)
 create mode 120000 config/rootfiles/core/204/filelists/file

diff --git a/config/rootfiles/core/204/filelists/file b/config/rootfiles/core/204/filelists/file
new file mode 120000
index 000000000..0c60e43aa
--- /dev/null
+++ b/config/rootfiles/core/204/filelists/file
@@ -0,0 +1 @@
+../../../common/file
\ No newline at end of file
-- 
2.54.0

[PATCH] core204: Ship sysstat

[Adolf Belka]

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 config/rootfiles/core/204/filelists/sysstat | 1 +
 1 file changed, 1 insertion(+)
 create mode 120000 config/rootfiles/core/204/filelists/sysstat

diff --git a/config/rootfiles/core/204/filelists/sysstat b/config/rootfiles/core/204/filelists/sysstat
new file mode 120000
index 000000000..cec8f445f
--- /dev/null
+++ b/config/rootfiles/core/204/filelists/sysstat
@@ -0,0 +1 @@
+../../../common/sysstat
\ No newline at end of file
-- 
2.54.0

[PATCH] elinks: Update to version 0.19.1

[Adolf Belka]

- Update from version 0.19.0 to 0.19.1
- No change to rootfile
- Changelog
0.19.1
* compilation fixes for Ruby scripting #410
* Disable poll on macOS < 10.6
* bookmarks xbel did not restore positions. #415
* use after free in forms code
* NULL dereference in iframes code (crash at github) #418
* Add action move-cursor-line-end. #416
* bool option document.browse.wrap. #420
* bool options ui.clipboard.remove_leading_spaces and
	ui.clipboard.remove_trailing_spaces #416
* Serbian translation update
* fix in gopher #421

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 lfs/elinks | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lfs/elinks b/lfs/elinks
index 9c7912d15..298a011b9 100644
--- a/lfs/elinks
+++ b/lfs/elinks
@@ -26,7 +26,7 @@ include Config
 
 SUMMARY    = An advanced and well-established feature-rich text mode web browser
 
-VER        = 0.19.0
+VER        = 0.19.1
 
 THISAPP    = elinks-$(VER)
 DL_FILE    = $(THISAPP).tar.xz
@@ -42,7 +42,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = 98dc66268239f70539df1c8a4de3221d0be175d1f2dc7ed44ced24dc1265b7b43db929c1d2ac530b268d1509a4e94a2f08725b442e508c1f827b54f54a72cb99
+$(DL_FILE)_BLAKE2 = a61494a8641c5021220cf7cd17ba117a50c146ced3427e9c6e1120e4764e596ded191f224b79560399c63a03e3a3b836c62ad2c1ad54971ef0b553ed13a23eb5
 
 install : $(TARGET)
 
-- 
2.54.0

[PATCH] expat: Update to version 2.8.2

[Adolf Belka]

- Update from version 2.8.1 to 2.8.2
- Update of rootfile
- 13 CVE fixes
- Changelog
2.8.2
Security fixes:
           #1246  CVE-2026-50219 -- Disallow calls to functions
                    `XML_GetBuffer`, `XML_Parse`, `XML_ParseBuffer`,
                    `XML_ParserFree`, `XML_ParserReset` to guard e.g.
                    Expat bindings from memory corruption;
                    this CPython issue is related:
                    https://github.com/python/cpython/issues/146169
           #1267  CVE-2026-56131 -- Protect XML_ResumeParser from being called
                                    from a handler, plugging a hole in the fix
                                    to CVE-2026-50219
           #1272  CVE-2026-56132 -- Fix out-of-bound scaffolding index store
                                    in `doProlog`
     #1229 #1232  CVE-2026-56403 -- Integer overflow in `storeAtts`
           #1249  CVE-2026-56404 -- Integer overflow in `addBinding`
           #1251  CVE-2026-56405 -- Integer overflow in `getAttributeId`
           #1255  CVE-2026-56406 -- Integer overflow in `XML_ParseBuffer`
           #1262  CVE-2026-56407 -- Integer overflow in `textLen` handling
            #565  CVE-2026-56408 -- Integer overflow in `copyString`
                    (commit 16e2efd867ea8567ffa012210b52ef5918e20817)
           #1259  CVE-2026-56409 -- xmlwf: Integer overflow in output path join
           #1252  CVE-2026-56410 -- xmlwf: Integer overflow in
                    `resolveSystemId`
           #1263  CVE-2026-56411 -- xmlwf: Integer overflow in notation list
                    allocation
           #1278  CVE-2026-56412 -- Guard XML_TOK_DATA_CHARS handler calls in
                    `doCdataSection`, plugging a hole in the fix to
                    CVE-2026-50219

Bug fixes:
           #1260  xmlwf: Escape names and base URI in meta output
           #1266  xmlwf: Pick a safe quote for notation system and public IDs
Other changes:
           #1257  CMake|Autotools: Stop using /dev/urandom by default
     #1244 #1254  CMake: Fix guard for Unix sources of entropy
     #1183 #1270  CMake|Windows: Add missing export for symbol
                                 `XML_SetHashSalt16Bytes`
           #1236  CMake: Mark option EXPAT_OSSFUZZ_BUILD as advanced
           #1283  Limit output indentation for EXPAT_ENTITY_DEBUG=1 and
                    allow unlimited indentation via EXPAT_ENTITY_DEBUG=2
            #565  Replace some loops by use of `memcpy`, `strlen`, `wcslen`
           #1220  lib: Use a size_t for group sizes
           #1221  lib: Fix too-conservative integer overflow check when
                       appending raw name
           #1222  lib: Simplify attribute allocation/management logic
           #1224  Update fallthrough annotations to satisfy Clang and GCC
           #1226  lib: Remove unnecessary void * casts in random code
           #1228  lib: Reduce scope of locals in storeAtts
           #1230  lib: Count attributes with size_t variables
           #1238  Minor get-buffer improvements
     #1239 #1240  lib|tests: Include header expat_config.h first
           #1241  lib: Shrink size of XML_GetBuffer
           #1242  lib: Remove a legacy comment
           #1243  lib: XML_ParserReset: Extract repeated linked-list move logic
           #1243  lib: Unify entity free lists
           #1247  lib: Fix use of '0' as boolean literal
           #1248  lib: Make XML_Index overflow check more intuitive
           #1256  lib: Use size_t for counting string/URI lengths
           #1258  lib: XML_GetInputContext: Remove use of 0 for NULL
           #1261  Comment typo fixes
           #1275  Teach Memory Sanitizer semantics of randomization functions
     #1276 #1281  Version info bumped from 13:1:12 (libexpat*.so.1.12.1)
                    to 13:2:12 (libexpat*.so.1.12.2); see https://verbump.de/
                    for what these numbers do
Infrastructure:
           #1231  perl-integration.yml: Bump to XML::Parser 2.59
           #1237  emscripten.yml: Bump from Ubuntu 22.04 to 24.04
     #1183 #1271  windows-build.yml: Cover completeness of file
                                     libexpat.def.cmake
           #1274  linux.yml: Make llvm-symbolizer available in CI

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 config/rootfiles/common/expat | 20 ++++++++++----------
 lfs/expat                     |  4 ++--
 2 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/config/rootfiles/common/expat b/config/rootfiles/common/expat
index b13257ddb..0f15469d3 100644
--- a/config/rootfiles/common/expat
+++ b/config/rootfiles/common/expat
@@ -2,21 +2,21 @@
 #usr/include/expat.h
 #usr/include/expat_config.h
 #usr/include/expat_external.h
-#usr/lib/cmake/expat-2.8.1
-#usr/lib/cmake/expat-2.8.1/expat-config-version.cmake
-#usr/lib/cmake/expat-2.8.1/expat-config.cmake
-#usr/lib/cmake/expat-2.8.1/expat-noconfig.cmake
-#usr/lib/cmake/expat-2.8.1/expat.cmake
+#usr/lib/cmake/expat-2.8.2
+#usr/lib/cmake/expat-2.8.2/expat-config-version.cmake
+#usr/lib/cmake/expat-2.8.2/expat-config.cmake
+#usr/lib/cmake/expat-2.8.2/expat-noconfig.cmake
+#usr/lib/cmake/expat-2.8.2/expat.cmake
 #usr/lib/libexpat.la
 #usr/lib/libexpat.so
 usr/lib/libexpat.so.1
-usr/lib/libexpat.so.1.12.1
+usr/lib/libexpat.so.1.12.2
 #usr/lib/pkgconfig/expat.pc
 #usr/share/doc/expat
-#usr/share/doc/expat-2.8.1
-#usr/share/doc/expat-2.8.1/ok.min.css
-#usr/share/doc/expat-2.8.1/reference.html
-#usr/share/doc/expat-2.8.1/style.css
+#usr/share/doc/expat-2.8.2
+#usr/share/doc/expat-2.8.2/ok.min.css
+#usr/share/doc/expat-2.8.2/reference.html
+#usr/share/doc/expat-2.8.2/style.css
 #usr/share/doc/expat/AUTHORS
 #usr/share/doc/expat/changelog
 #usr/share/man/man1/xmlwf.1
diff --git a/lfs/expat b/lfs/expat
index 2ba04ca09..480d98b65 100644
--- a/lfs/expat
+++ b/lfs/expat
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 2.8.1
+VER        = 2.8.2
 
 THISAPP    = expat-$(VER)
 DL_FILE    = $(THISAPP).tar.xz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = 529551f960a1e611be6a0e9ff579e136ccad676d7e99ef8183bbee83969bf4cd37177444759ccbccc48c1bd49d2b0c3bd8f1f91862f272b54a23ad1b932d2f9d
+$(DL_FILE)_BLAKE2 = f037cb75f86652fbddd3474f2b7a1293e9b77b540475fa34432a8304ddc58b3eafbab5150a5b591fc4a889d895507b0d379032cdd0c474445ac0aa9e518bef18
 
 install : $(TARGET)
 
-- 
2.54.0

[PATCH] fetchmail: Update to version 6.6.5

[Adolf Belka]

- Update from version 6.6.0 to 6.6.5
- No chyange to rootfile
- Changelog
6.6.5
SECURITY BUGFIX
* POP3 with RPA: fix calculation of buffer sizes to avoid buffer overflow
  on long service challenges with long user IDs, which would smash our stack.
    Triggering this requires that 1. RPA is enabled at compile time
  (non-default, which is discouraged in autotools, and possible but not
  documented nor supported in meson), and the username (--user option, or user
  in the rcfile) contains @compuserve.com anywhere, and the server supports an
  AUTH command without arguments (which is a non-standard local extension), and
  that it offers RPA authentication in response to that command.
  This was reported based on an incomplete semi-wrong AI report with an
  incomplete fix "recommendation" by zhangph12138@outlook.com via
  fetchmail-devel@.  The fix suggested in that AI report was wrong, and
  would happily crash a few lines later again.  The fix deployed calculates
  the buffer size of "workarea" variables based on the sizeof() of constituent
  components.
BUGFIX
* Robustness: If RPA is enabled at compile time and POP3 is in use,
  do not barf if @compuserve.com is in the remote site's username (what you'd
  pass as --user, or user in the rcfile) and the remote site either does not
  support an "AUTH" command without parameters (normally, one is required, but
  some servers such as jpop and Cyrus allow AUTH to request the list of
  supported authentication types as an extension; the standard way would be
  a "CAPA" request instead), but try other authentication methods.
  Found by code auditing in response to a bug report against rpa.c.
  Note that enabling RPA is discouraged because it is based on the weak
  MD5 crypto algorithm.
6.6.4
BUGFIX
* The IMAP client will now properly quote the folder name given with the
  moveto rcfile option, or --moveto command-line option.
  Report and bugfix contributed by Corben Dallas.
BUILD IMPROVEMENTS
* meson-based builds with wolfSSL should now also work when meson finds
  the wolfssl package through cmake, instead of pkgconfig. This is unsupported
  and depends on internal set(_wolfssl_includedir "...") in wolfSSL's
  lib/cmake/*.cmake files, and works as of wolfSSL 5.9.1.
  The supported way to build fetchmail with wolfSSL with meson is
  to make sure that wolfSSL is found with pkgconfig, as in (change /path/to!)
  meson setup --pkg-config-path /path/to/wolfssl/lib/pkgconfig
EXPERIMENTAL CHANGES - these are not documented anywhere else, only here:
* fetchmail supports AWS-LC 1.71 or newer, since its relicensing to
  the Apache license v2.0.  Note this requires you to distribute fetchmail
  under terms of the GPLv3 because the GPLv2 is claimed incompatible
  with Apache license (this is no different for OpenSSL 3 or newer,
  or the one wolfSSL version that was GPLv3 licensed).
* fetchmail supports a FETCHMAIL_SSL_SECLEVEL environment variable
  (since 6.5.0, except when using AWS-LC where it is silently ignored),
  which can be used to override the OpenSSL security level.
  Fetchmail by default raises the security level to 2 if lower.
  This variable can be used to lower it.
  Use with extreme caution. Note that levels 3 or higher will frequently cause
  incompabilities with servers because server-side data sizes are often too low.
  Valid range: 0 to 5 for OpenSSL 1.1.1 and 3.0.
* fetchmail supports a FETCHMAIL_SSL_CIPHERS environment variable
  (since 6.5.0) that sets the cipher string (through two different OpenSSL
  functions) for SSL and TLS versions up to TLSv1.2.
  If setting the ciphers fails, fetchmail will not connect.
  If not given, defaults to "HIGH:MEDIUM:+RC4:@STRENGTH:!aNULL" - note
  that +RC4 is supposed to move the RC4 to the end of the list, not add it.
* fetchmail supports a FETCHMAIL_TLS13_CIPHERSUITES environment variable
  (since 6.5.0) that sets the ciphersuites (a colon-separated list,
  without + ! -) for TLSv1.3. If not given, defaults to the SSL library's
  built-in list. If setting the ciphersuites fails, fetchmail refuses to
  connect.
* NOTE the features above are simplistic. For instance, even though you
  configure --sslproto tls1.3, a failure to set tls1.2 ciphers could cause
  a connection abort.
6.6.3
COMPATIBILITY:
* fetchmail can now be built with OpenSSL 4.0.0 (tested as of -beta1).
6.6.2
BUGFIX:
* fetchmail 6.6.0 and 6.6.1 could not be configured without SSL, it would break
  compiling sink.c.  Fix compilation.  Report by Toralf Förster, analysis and
  different patch suggested by Holger Hoffstätte, fixes #86.
  https://bugs.gentoo.org/967258 and
  https://gitlab.com/fetchmail/fetchmail/-/issues/86
6.6.1
TRANSLATIONS were updated by these fine people (randomized order):
* sr:    Мирослав Николић [Serbian]
* es:    Cristian Othón Martínez Vera [Spanish]

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 lfs/fetchmail | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/lfs/fetchmail b/lfs/fetchmail
index d88907db0..e3d4e1dd0 100644
--- a/lfs/fetchmail
+++ b/lfs/fetchmail
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2025  IPFire Team  <info@ipfire.org>                     #
+# Copyright (C) 2007-2026  IPFire Team  <info@ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -26,7 +26,7 @@ include Config
 
 SUMMARY    = Full-Featured POP and IMAP Mail Retrieval Daemon
 
-VER        = 6.6.0
+VER        = 6.6.5
 
 THISAPP    = fetchmail-$(VER)
 DL_FILE    = $(THISAPP).tar.xz
@@ -34,7 +34,7 @@ DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
 PROG       = fetchmail
-PAK_VER    = 24
+PAK_VER    = 25
 
 DEPS       =
 
@@ -48,7 +48,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = bf308bfd1769b7092585d3af32aaef91206b315d87bd81794c9f04b65980e3cadd6a6c7ff1f5fd2c7ada0620dccecb14c3022224e17c5d075ea21e391408bdb8
+$(DL_FILE)_BLAKE2 = cceb7a0673f6aea76fe5619c0b6a4cd25566adc31b8d9a8e574b3abf8584107b882f71a63d5690ce76822044cc8a2dd431e44813002740ebcbd3cc55b4e9105f
 
 install : $(TARGET)
 
-- 
2.54.0

[PATCH] file: Update to version 5.48

[Adolf Belka]

- Update from version 5.47 to 5.48
- No change to rootfile
- Changelog
5.48
	* add landlock support (valoq)
	* add BE/LE GUID
	* multiple fixes to prevent integer overflow in 32 bits (kerwin)
	* PR/745: streamout: Don't flush when trying to set negative offsets
	          on pipes, just continue, fixes 'cat file.zip | file -'
	* PR/753: vmihalko: Fix race is magic_getpath()
	* PR/728: Anton Monroe: Reinstate regex/c

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 lfs/file | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lfs/file b/lfs/file
index d347b37ba..333532a1d 100644
--- a/lfs/file
+++ b/lfs/file
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 5.47
+VER        = 5.48
 
 THISAPP    = file-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = 52b91ee7868a9b75431e00fca7f7db1362b3d39eb065f52434ea73d9ccd7497f3371f7e0a455644c56df3e6acee247208edc47bf8004fa922dba32786cc3e10c
+$(DL_FILE)_BLAKE2 = d8ca86ec79db28c59d7c5da9282fb5fa03a0775147856cb4d35528f12d2eb4293aca3336cb0e5108ce56c2f6a255e5b36957ba826b185575531508176f2af06a
 
 install : $(TARGET)
 
-- 
2.54.0

[PATCH] postfix: Update to version 3.11.4

[Adolf Belka]

- Update from version 3.11.3 to 3.11.4
- No change to rootfile
- Changelog
3.11.4
Major changes - database
[Incompat 20260220] The alias_maps and alias_database parameter
 default values have changed from hash:/path/to/aliases (or
 dbm:/path/to/aliases) to $default_database_type:/path/to/aliases.
 This simplifies the migration away from Berkeley DB.
[Infrastructure 20260219] Support to migrate a Postfix configuration
 that uses Berkeley DB hash: or btree: tables, to a configuration
 that uses lmdb: or a combination of cdb: and lmdb:. This is needed
 for (Linux) OS distributions that have removed Berkeley DB support.
 See NON_BERKELEYDB_README for manual and automatic migration support.
Postfix already supports CDB and LMDB for more than 10 years.  It
 may be a good idea to do the migration before you need to upgrade
 to an OS distribution that no longer supports Berkeley DB.
[Infrastructure 20251226] Tooling to help with the migration away
 from Berkeley DB.
The new parameter default_cache_db_type controls the default database
 type for address_verify_map, postscreen_cache_map, and
 smtp_sasl_auth_cache_name, previously hard-coded as 'btree'.
[Feature 20250321] Safety: the SQLite client now logs a warning
 when a query uses double quotes instead of the Postfix-recommended
 single quotes. Only the recommended form is protected against SQL
 injection.
[Feature 20250509] Support to run all memcache lookup keys through
 an OpenSSL digest function. This prevents a database access error
 when lookup keys may exceed the memcache server's key length limit
 (usually, 250 bytes).
[Feature 20250624] Support for a new "debug:" pseudo lookup table.
 Specify debug:maptype:mapname to encapsulate a maptype:mapname
 lookup table and log all access. This builds on existing but unused
 code to log table access. Contributed by Richard Hansen.
[Infrastructure 20250626] Overhauled in-memory lookup table life-cycle
 management; overhauled sharing/isolation for proxied lookup tables.
Major changes - deprecation
[Feature 20250609] smtp_tls_enforce_peername and lmtp_tls_enforce_peername
 are now officially deprecated. Postfix will log a warning until the
 features are deleted. See DEPRECATION_README for a summary of
 deprecated and deleted features.
[Feature 20251027] This adds 12 more deprecation warnings for
 parameters that have been renamed in the past, and that still provide
 a backwards-compatible default value for their replacement. The
 parameters deprecated by this change are: authorized_verp_clients,
 fallback_relay, lmtp_per_record_deadline, postscreen_blacklist_action,
 postscreen_dnsbl_ttl, postscreen_dnsbl_whitelist_threshold,
 postscreen_whitelist_interfaces, smtpd_client_connection_limit_exceptions,
 smtp_per_record_deadline, tlsproxy_client_level, tlsproxy_client_policy,
 virtual_maps.
[Feature 20251028] Deprecate the smtp_cname_overrides_servername
 and lmtp_cname_overrides_servername parameters, and delete documentation
 that has been obsolete since Postfix 2.11.
Major changes - logging
[Feature 20250910] TLS feature policy status summary in delivery
 status logging. This shows the desired and actual TLS security level
 enforcement status and, if a message requests REQUIRETLS, the
 REQUIRETLS policy enforcement status. For a list of examples see
 https://www.postfix.org/postconf.5.html#smtp_log_tls_feature_status
[Feature 20251216] After a delivery failure, the bounce daemon
 logged "<old-queue-id>: sender non-delivery notification: <new-queue-id>"
 only if the notification was queued successfully. The bounce daemon
 now always logs this, making Postfix behavior easier to understand.
Visible changes for logfile analyzers:
- The bounce daemon now logs "<old-queue-id>: sender non-delivery
 notification: <new-queue-id>" BEFORE the cleanup daemon logs activity
 with "<new-queue-id>". Previously, the bounce daemon logged the
 old<=>new queue ID connection later, which made logfile analysis
 more difficult.
- The bounce daemon now logs a logfile record "<old-queue-id>:
 sender notification failed to <address>: <reason>" when the
 notification was not queued. In some cases it will log "<old-queue-id>:
 sender notification failed to <address>" (without the reason). In
 those cases the failure reason was already logged by lower-level
 code, but without the queue ID.
Major changes - management tool integration
[Feature 20251124] Basic JSON output support with "postconf
 -j|-jM|-jF|-jP", "postalias -jq|-js", "postmap -jq|-js", and
 "postmulti -jl". No support is planned for JSON input support.
Major changes - milter support
[Feature 20251208] Improved Milter error handling for messages that
 arrive over a long-lived SMTP connection, by changing the default
 milter_default_action from "tempfail" to the new "shutdown" action
 (i.e. disconnect the remote SMTP client).
This avoids a worst-case scenario where after a single Milter error,
 Postfix would tempfail all messages that the client sends over a
 long-lived connection, even if the Milter error was only temporary.
Major changes - mime support
[Feature 20251104] New non_empty_end_of_header_action parameter
 with the cleanup(8) server action when a primary message header is
 terminated with a non-empty line:
1) fix_quietly: Insert an empty line before the offending text (the
 backwards-compatible default),
2) add_header: Insert a MIME-Error: header before inserting an empty
 line, or
3) reject: Log a "mime-error" and reject the message.
 Note that the 'empty line' separator is not used for DKIM signature
  checks. Therefore, adding a missing separator does not break DKIM.
Major changes - mta-sts
[Feature 20250906] Workaround for an interface mis-match between
 the Postfix SMTP client and MTA-STS policy plugins. This introduces
 a new parameter "smtp_tls_enforce_sts_mx_patterns" (default: "yes").
 The MTA-STS plugin configuration needs to enable TLSRPT support,
 so that it forwards STS policy attributes to Postfix. This works
 even if Postfix TLSRPT support is disabled at build time or at
 runtime.
With the above two configurations, the Postfix SMTP client will
 connect to an MX host only if its name matches any STS policy MX
 host pattern, and will match a server certificate against the MX
 hostname. Otherwise, the old behavior stays in effect: connect to
 any MX host listed in DNS, and match a server certificate against
 any STS policy MX host pattern.
This code was published first in Postfix 3.11, and later back-ported
 to Postfix 3.10.5.
Major changes - portability
[Feature 20241201] Support for the C23 built-in bool type. Older
 Postfix releases have been updated with a makedefs script that
 disables C23 built-in bool support.
Major changes - postqueue
[Feature 20251218] the postqueue (and mailq) command now also lists
 recipients in bounce logfiles (in JSON output, this uses a new
 object member 'bounce_reason' instead of the existing 'delay_reason').
 Such recipients have already been deleted from the message queue
 file, but they are still pending the creation of a non-delivery
 status notification message that will be returned to the sender.
Major changes - relocated_maps
[Feature 20250608] Specify "relocated_prefix_enable = no" to disable
 the hard-coded prefix "5.1.6 User has moved to " that is by default
 prepended to all relocated_maps lookup results. This setting requires
 that the table contains responses with both custom enhanced status
 code (X.Y.Z) and text. For details, see "man 5 relocated" or
 https://www.postfix.org/relocated.5.html .
Major changes - requiretls
[Feature 20241111] Support for the REQUIRETLS verb in SMTP. This,
 and everything that was added later through 2025, is described in
 REQUIRETLS_README.
[Feature 20250120] After a certificate check fails, or a remote
 SMTP server does not announce REQUIRETLS support, the Postfix SMTP
 client will override the RFC 8689 5.x.x.  status and treat it as a
 soft error, until there are no more alternate MX servers to try.
[Feature 20250827] New parameter requiretls_redact_dsn (default:
 yes) to redact bounce messages as described in RFC 8689 section 5,
 so that they don't need REQUIRETLS support on every hop in the
 return path.
[Feature 20250827] smtp_requiretls_policy and lmtp_requiretls_policy
 for responsible REQUIRETLS policy enforcement. REQUIRETLS must be
 enforced with care, because at this time most domains do not publish
 DANE or MTA-STS policies, and most MTAs and content filters do not
 support REQUIRETLS.
[Feature 20250916] support for a "Require-TLS-ESMTP: yes" header
 to propagate an ESMTP REQUIRETLS request through a FILTER_README
 or SMTPD_PROXY_README style content filter. This header is detected
 or added by the cleanup daemon and by the before-proxy-filter Postfix
 SMTP server. This feature is enabled by default with
 "requiretls_esmtp_header = yes". The Require-TLS-ESMTP header will
 be visible to local and remote recipients. This feature can safely
 be disabled when a configuration does not use REQUIRETLS, or does
 not use FILTER_README or SMTPD_PROXY_README style content filters.
Major changes - smtp server
[Feature 20250801] smtpd_reject_filter_maps support to selectively
 replace a reject response from the Postfix SMTP server, or from a
 program that replies through the Postfix SMTP server.
Major changes - smtputf8
[Feature 20250122] New Postfix sendmail command option "-O smtputf8"
 to request that deliveries over SMTP use the SMTPUTF8 extension.
 This reuses logic that was introduced for REQUIRETLS.
[Feature 20250824] When a message needs to be delivered with SMTPUTF8,
 but a remote server does not support it, the Postfix SMTP client
 may now try alternate servers instead of returning the message
 immediately. This reuses code that was implemented for REQUIRETLS.
Major changes - tls support
[Feature 20250623] This changes the Postfix SMTP client
 smtp_tls_security_level default value to "may" if Postfix was built
 with TLS support, and the compatibility_level is 3.11 or higher.
There is no change to the default lmtp_tls_security_level value.
 It remains empty, because there is no default TLS security level
 that makes sense for connections over UNIX-domain and loopback TCP
 and non-loopback TCP sockets.
There also is no equivalent change for Postfix SMTP server TLS
 security levels, because changing smtpd_tls_security_level is not
 sufficient. Server-side TLS requires that at least one private key
 and corresponding public-key certificate chain are configured.
[Feature 20251029] Debugging: depending on OpenSSL build options,
 "posttls-finger -L ssl-debug" will decode TLS handshake messages.
[Feature 20251102] Post-quantum cryptography support: with OpenSSL
 3.5 and later, change the tls_eecdh_auto_curves default value to
 avoid problems with network infrastructure that mis-handles TLS
 hello messages larger than one (Ethernet) TCP segment. This problem
 is more generally known as "protocol ossification".
Major changes - tlsrpt
[Incompat 20250601] the default smtp_tlsrpt_skip_reused_handshakes
 setting was changed from "yes" to "no". The new default is enabled
 with compatibility level >= 3.11.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 lfs/postfix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lfs/postfix b/lfs/postfix
index 46de2c8e9..771588125 100644
--- a/lfs/postfix
+++ b/lfs/postfix
@@ -26,7 +26,7 @@ include Config
 
 SUMMARY    = A fast, secure, and flexible mailer
 
-VER        = 3.11.3
+VER        = 3.11.4
 
 THISAPP    = postfix-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -34,7 +34,7 @@ DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
 PROG       = postfix
-PAK_VER    = 53
+PAK_VER    = 54
 
 DEPS       =
 
@@ -72,7 +72,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = f88dd4e4b607ef729892ba3843c08b9d54864a2cc6605d9578eee85291be9918bf7f0d69cb2cff0b7e756de540c63c6ede1244557eb0027ca978484460085f6b
+$(DL_FILE)_BLAKE2 = 7c41d43987949076d45507372cce748b6bd1a8a1407fa032ecaf91ab1ad086068e7920d43df0c8b8c47f415c8ccbeaeb7862470aa322f51176e197fbe941ca4f
 
 install : $(TARGET)
 
-- 
2.54.0

[PATCH] strace: Update to version 7.1

[Adolf Belka]

- Update from version 6.18 to 7.1
- No change to rootfile
- Changelog
7.1
* Improvements
  * Implemented wall-clock-aware columns (wall-total, wall-min, wall-max,
    wall-avg) for the -c/--summary-only report, allowing wall-clock and
    system CPU times to be displayed side by side in a single run.
  * Included out-of-range syscalls in the -c/--summary-only report.
  * Updated decoding of sched_getattr syscall.
  * Implemented decoding of FS_IOC_SHUTDOWN, PIDFD_GET_INFO, and
    PIDFD_GET_*_NAMESPACE ioctl commands.
  * Implemented decoding of IFLA_BR_FDB_N_LEARNED, IFLA_BR_FDB_MAX_LEARNED,
    and IFLA_BR_STP_MODE netlink attributes.
  * Updated lists of CLONE_*, FSMOUNT_*, KT_*, KVM_*, LANDLOCK_*, NETDEV_*,
    NL80211_*, and PIDFD_* constants.
  * Updated lists of ioctl commands from Linux 7.1.
7.0
* Improvements
  * Implemented optional colorized trace output.
  * Implemented decoding of rseq and rseq_slice_yield syscalls.
  * Implemented decoding of BPF_TRACE_FSESSION bpf attach type.
  * Implemented decoding of BPF_PROG_ASSOC_STRUCT_OPS bpf command.
  * Implemented decoding of UDMABUF_CREATE, UDMABUF_CREATE_LIST,
    and VIDIOC_QUERYMENU ioctl commands.
  * Updated decoding of statmount syscall flags.
  * Updated lists of BPF_*, BTRFS_*, FS_*, IORING_*, KEY_*, KVM_*, NT_*,
    OPEN_TREE_*, PR_*, V4L2_*, and *_MAGIC constants.
  * Updated lists of ioctl commands from Linux 7.0.
6.19
* Improvements
  * Implemented decoding of listns syscall.
  * Implemented decoding of F_GET_RW_HINT, F_SET_RW_HINT, F_GET_FILE_RW_HINT,
    F_SET_FILE_RW_HINT, F_GETDELEG, and F_SETDELEG fcntl commands.
  * Implemented decoding of IORING_REGISTER_SEND_MSG_RING,
    IORING_REGISTER_ZCRX_IFQ, IORING_REGISTER_RESIZE_RINGS,
    IORING_REGISTER_MEM_REGION, IORING_REGISTER_QUERY, and
    IORING_REGISTER_ZCRX_CTRL opcodes of io_uring_register syscall.
  * Implemented decoding of extended argument structures for io_uring_enter
    syscall when IORING_ENTER_EXT_ARG or IORING_ENTER_EXT_ARG_REG flags are set.
  * Implemented decoding of attr_ptr and attr_type_mask fields of
    struct io_uring_sqe for io_uring_register syscall.
  * Implemented opcode-specific decoding of flags union and ioprio fields
    of struct io_uring_sqe for io_uring_register syscall.
  * Implemented decoding of 128-byte SQEs for io_uring_register syscall.
  * Implemented decoding of socket operations (SOCKET_URING_OP_*) for
    io_uring URING_CMD and URING_CMD128 operations when the file descriptor
    is a socket.
  * Updated decoding of struct mnt_id_req and struct perf_event_attr.
  * Updated lists of ABS_*, BPF_*, ETHTOOL_*, ETH_P_*, IORING_*, KVM_*, PERF_*,
    TLS_*, V4L2_*, and *_MAGIC constants.
  * Updated lists of ioctl commands from Linux 6.19.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 lfs/strace | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lfs/strace b/lfs/strace
index 5144bb6c9..e3ba4cf76 100644
--- a/lfs/strace
+++ b/lfs/strace
@@ -26,7 +26,7 @@ include Config
 
 SUMMARY    = A utility to trace the system calls of a program
 
-VER        = 6.18
+VER        = 7.1
 SUP_ARCHES = x86_64 aarch64
 
 THISAPP    = strace-$(VER)
@@ -35,7 +35,7 @@ DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
 PROG       = strace
-PAK_VER    = 15
+PAK_VER    = 16
 
 DEPS       =
 
@@ -49,7 +49,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = ba9798496102c2c1d2310d9dea746d9517d58c2e9ad7e630beee294806d24a617c8a8950d0e118d6190b61ab17f5d8020d02b0a56c4740df62104dd2906206c0
+$(DL_FILE)_BLAKE2 = 755ebf184008896bbb8537918b54ca00a7206a6e553a70b19d46554cada314315d3dc92ebef53c661634bd270a7b51e2131d524134a7a76cd93e40d0ec294380
 
 install : $(TARGET)
 
-- 
2.54.0

[PATCH] stunnel: Update to version 5.78

[Adolf Belka]

- Update from version 5.72 to 5.78
- No change to rootfile
- Changelog
5.78
* Security bugfixes
  - OpenSSL DLLs updated to version 3.5.6.
* Bugfixes
  - Fixed WIN32 transfer() loop errors with OOB TCP.
  - Fixed a memory leak introduced in version 5.73.
  - Build fix for systems without timegm()
    (thanks to Jose A. Diaz and Shubham Gupta).
  - Fixed a startup crash when both global (default)
    and service-level lists of values are configured
    for an option.
* Features
  - Support for zstd and brotli compression with OpenSSL 3.2
    and TLS 1.2 or older.
  - WIN32 OpenSSL build with zlib and zstd support.
  - Support for new "options" parameter values.
  - Less bloated errors on an invalid configuration file.
  - Documentation updated from Pod to Pandoc Markdown.
  - Removed support for OpenSSL versions older than 0.9.8.
    The final update for the OpenSSL 0.9.7 branch
    (0.9.7m) was issed on 23 Feb 2007.
5.77
* Security bugfixes
  - OpenSSL DLLs updated to version 3.5.5.
* Bugfixes
  - Avoid attempting to fetch OCSP stapling for PSK-only
    configuration sections.
* Features
  - Merged applicable patches from Fedora and Debian:
    - Use SOURCE_DATE_EPOCH for reproducible builds.
    - Skip the OpenSSL version check when AUTOPKGTEST_TMP is set.
    - Enable PrivateTmp in the stunnel.service template.
    - Clarify the manual page for the "curves" option.
  - Log client IP addresses on TLS errors.
5.76
* Security bugfixes
  - OpenSSL DLLs updated to version 3.5.4.
  - Service-level multivalued options now override (rather than
    append to) global defaults, preventing unintended configurations.
* Bugfixes
  - Fixed enabling/disabling of the default fips=yes property.
  - Missing OCSP stapling is no longer logged as an error.
  - Fixed a crash when a PIN was required due to the PKCS#11
    CKA_ALWAYS_AUTHENTICATE attribute.
* Features
  - Quantum-resistant hybrid key agreement X25519+ML-KEM-768
    (X25519MLKEM768) used by default with OpenSSL 3.5+ and TLS 1.3.
  - Multiple cert sources are supported, allowing a certificate to
    be fetched from a provider while loading the chain from a file.
  - Android build switched to a 16 KB page size.
5.75
* Security bugfixes
  - OpenSSL DLLs updated to version 3.4.1.
  - OpenSSL FIPS Provider updated to version 3.1.2.
* Bugfixes
  - Fixed infinite loop triggered by OCSP URL parsing errors
    (thanks to Richard Könning for reporting).
  - Fixed OPENSSL_NO_OCSP build issues
    (thanks to Dmitry Mostovoy for reporting).
  - Fixed default curve selection in FIPS mode with OpenSSL 3.4+.
  - Fixed tests with modern Python versions.
  - Fixed tests with multiple OpenSSL versions installed.
* Features
  - Added provider URI support for "cert" and "key" options.
  - Added new "CAstore" service-level option (OpenSSL 3.0+).
  - Added "provider" (OpenSSL 3.0+), "providerParameter"
    (OpenSSL 3.5+), and "setEnv" global options.
  - Key file/URI path added to passphrase prompt on Unix.
  - PKCS#11 provider installed on Windows.
5.74
* Bugfixes
  - Fixed a stapling cache deallocation crash.
  - Fixed "redirect" with protocol negotiation.
* Features
  - "protocolHost" support for "socks" protocol clients.
  - More detailed logs in OpenSSL 3.0 or later.
5.73
* Security bugfixes
  - OpenSSL DLLs updated to version 3.3.2.
  - OpenSSL FIPS Provider updated to version 3.0.9.
* Bugfixes
  - Fixed a memory leak while reloading stunnel.conf
    sections with "client=yes" and "delay=no".
  - Fixed TIMEOUTocsp with values greater than 4.
  - Fix the IPv6 test on a non-IPv6 machine.
* Features
  - HELO replaced with EHLO in the post-STARTTLS SMTP
    protocol negotiation (thanks to Peter Pentchev).
  - OCSP stapling fetches moved away from server threads.
  - Improved client-side session resumption.
  - Added support for the mimalloc allocator.
  - Check for protocolHost moved to configuration file
    processing for the client-side CONNECT protocol.
  - Clarified some confusing OpenSSL's certificate
    verification error messages.
  - stunnel.nsi updated for Debian 13 and Fedora.
  - Improved NetBSD compatibility.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 lfs/stunnel | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/lfs/stunnel b/lfs/stunnel
index 977b1ae71..c69af2873 100644
--- a/lfs/stunnel
+++ b/lfs/stunnel
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2024  IPFire Team  <info@ipfire.org>                     #
+# Copyright (C) 2007-2026  IPFire Team  <info@ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 5.72
+VER        = 5.78
 SUMMARY    = Universal TLS Tunnel
 
 THISAPP    = stunnel-$(VER)
@@ -33,7 +33,7 @@ DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
 PROG       = stunnel
-PAK_VER    = 13
+PAK_VER    = 14
 
 DEPS       =
 
@@ -47,7 +47,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = 2b4c6400cf25522592e237f35700f81c0092a827526155cb02f503a9b3af50242aea63c3b5389a62d002d6a2ec9e852f80cc9c48318f23d3f9d12ff42cbe5978
+$(DL_FILE)_BLAKE2 = 44538336d9f7075ebead1ae85c8c8609b54041565d076370b988b1c157a0a44533c03e1602cf3b055fab6a5ef0ce223a20a8fc0d7d1a59942bfde098db422442
 
 install : $(TARGET)
 
-- 
2.54.0

[PATCH] sysstat: Update to version 12.7.9

[Adolf Belka]

- Update from version 12.7.6 to 12.7.9
- Update of rootfile
- Changelog
12.7.9
	* sar: Fix pgsteal/s double value with recent kernels.
	* Allow Truecolor (RGB) SGR codes in sysstat commands output.
	* Don't display newline character within SGR-formatted text.
	* Rework several functions based on Mistral AI Le Chat's suggestions.
	* [Jun Lyu]: Fix missing dependencies in Makefile.in.
	* mpstat: No longer call get_HZ() function.
	* sar: Close file descriptors on fork() error.
	* Fix version number in sysstat.xsd document.
	* Check passed args in some functions.
	* common.c: Include ioconf.h header file only if SOURCE_SADC is
	  defined.
	* Mark various variables as constant.
	* Improve code clarity and readability.
	* Exit if calling sysconf() function fails.
	* Create format strings using string's real max value.
	* simtest: Fix gcc warning in legacy sar version.
	* Update sar and sadf manual page.
	* Update FAQ.
	* NLS: Translations updated.
	* Update non regression tests.
12.7.8
	* sar/sadf: Add new metric kbshmem.
	* sar/sadf: Now compute used memory as total memory - available memory.
	* sadf: Set availablekb to frmkb during conversion.
	* cifsiostat, iostat, mpstat, tapestat: Add new option -U to display
	  timestamps in seconds since the Epoch.
	* Trap SIGTERM with all sysstat commands.
	* mpstat: Go to next line when Ctrl/C is pressed.
	* Add support for out-of-tree building and testing.
	* sar: A_PWR_BAT: Fix wrong size used in memory initialization.
	* Makefile.in: Update dependencies for install_man target.
	* Makefile.in: Remove unused TFLAGS variable.
	* Makefile.in: Remove old references to nfsiostat.
	* DTD and XSD documents updated.
	* NLS translations updated.
	* sar, mpstat, iostat, cifsiostat and tapestat manual pages updated.
	* Various cosmetic changes in code and Makefile.
	* do_test: Add test target for out-of-tree build.
	* systest: Explicitly set signal to SIGINT.
	* Non regression tests: Remove root symlink in tests directory.
	* Non regression tests updated.
12.7.7
	* Rework overflow check function.
	* pidstat: Add JSON output format (option "-o JSON").
	* [Siddhi Katage]: pidstat: Fix bogus %usr values in pidstat output.
	* pidstat: Free structures before exiting.
	* pidstat: Make sure interval is specified when option -e is used.
	* pidstat: Create separate functions to display data for current task.
	* pidstat: Various cosmetic changes.
	* cifsiostat: Add JSON output format (option "-o JSON").
	* cifsiostat: Display error message when no CIFS fs are found.
	* cifsiostat: Add new option -y to tell cifsiostat to omit the first
	  report with statistics since system restart.
	* tapestat: Add JSON output format (option "-o JSON").
	* tapestat: Set handler for SIGALRM in rw_tape_stat_loop() function.
	* tapestat: Call write_sample_timestamp() to display timestamp.
	* mpstat: Properly terminate JSON output when ^C entered on first
	  interval.
	* iostat: Remove extra blank line when omitting first report.
	* cifsiostat, tapestat and pidstat manual pages updated.
	* Use the binary units (kibibytes, mebibytes...) instead of kilobytes,
	  megabytes... in all manual pages.
	* FAQ updated.
	* [Peter Portante]: Slight changes to compile on Mac OS X.
	* [Peter Portante]: Add missing "void" parameter to
	  init_custom_color_palette() function.
	* Use xflags variable for options used by multiple commands.
	* Move write_sample_timestamp() function to common.c file.
	* Update headers files included.
	* Add new non regression tests.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 config/rootfiles/common/sysstat | 12 ++++++------
 lfs/sysstat                     |  9 +++++----
 2 files changed, 11 insertions(+), 10 deletions(-)

diff --git a/config/rootfiles/common/sysstat b/config/rootfiles/common/sysstat
index b2cb2277b..acf034b1d 100644
--- a/config/rootfiles/common/sysstat
+++ b/config/rootfiles/common/sysstat
@@ -11,12 +11,12 @@ usr/bin/sar
 usr/lib/sa/sa1
 usr/lib/sa/sa2
 usr/lib/sa/sadc
-#usr/share/doc/sysstat-12.7.6
-#usr/share/doc/sysstat-12.7.6/CHANGES
-#usr/share/doc/sysstat-12.7.6/COPYING
-#usr/share/doc/sysstat-12.7.6/CREDITS
-#usr/share/doc/sysstat-12.7.6/FAQ.md
-#usr/share/doc/sysstat-12.7.6/README.md
+#usr/share/doc/sysstat-12.7.9
+#usr/share/doc/sysstat-12.7.9/CHANGES
+#usr/share/doc/sysstat-12.7.9/COPYING
+#usr/share/doc/sysstat-12.7.9/CREDITS
+#usr/share/doc/sysstat-12.7.9/FAQ.md
+#usr/share/doc/sysstat-12.7.9/README.md
 #usr/share/locale/af/LC_MESSAGES/sysstat.mo
 #usr/share/locale/be/LC_MESSAGES/sysstat.mo
 #usr/share/locale/cs/LC_MESSAGES/sysstat.mo
diff --git a/lfs/sysstat b/lfs/sysstat
index 788712375..ea7f0d665 100644
--- a/lfs/sysstat
+++ b/lfs/sysstat
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2024  IPFire Team  <info@ipfire.org>                     #
+# Copyright (C) 2007-2026  IPFire Team  <info@ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 12.7.6
+VER        = 12.7.9
 
 THISAPP    = sysstat-$(VER)
 DL_FILE    = $(THISAPP).tar.xz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = 5cb015dfad2b26a922862416d779ac26df18df0b4689ae1ad1b9f3dc3922dd577741bf019ebc979154d7bc708dbb7e9d21ce4c2e2c2a4896badf3847c06e82a7
+$(DL_FILE)_BLAKE2 = 8bbe38b98d85c8193578b8f5f5bb5d6296564e16d5af793d4bae4ed2b5de44b041e2651d247b612910ac8d033574a2e7f651b0f4dfacbcae1dc2146ecebd6094
 
 install : $(TARGET)
 
@@ -70,7 +70,8 @@ $(subst %,%_BLAKE2,$(objects)) :
 $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@$(PREBUILD)
 	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE)
-	cd $(DIR_APP) && ./configure --prefix=/usr
+	cd $(DIR_APP) && ./configure \
+				--prefix=/usr
 	cd $(DIR_APP) && make $(MAKETUNING)
 	cd $(DIR_APP) && make install
 	@rm -rf $(DIR_APP)
-- 
2.54.0