[PATCH 1/5] ffmpeg: Update to version 9.0.1

[PATCH 1/5] ffmpeg: Update to version 9.0.1

[Adolf Belka]

- Update from version 8.1.2 to 9.0.1
- Update of rootfile
- Changelog
9.0.1
 avcodec/lcldec: clear what the multithread chunks leave undecoded
 avformat/mlv: end the LJ92 packet where its data ends
 avformat/mpegts: reject a max_packet_size below one TS payload
 avformat/mpegts: keep the PES payload within max_packet_size
 avfilter/spectrumsynth: negotiate one pixel format for both inputs
 avfilter/afir: bound the crossfades by the samples of the input frame
 avformat/webp_anim_dec: use ffio_read_size for ICCP and EXIF chunk
 avformat/webp_anim_dec: use ffio_read_size for ICCP and EXIF chunks
 avformat/rtpenc_av1: do not narrow the OBU size to (long)
 avformat/rtpenc_av1: Check num_lebs
 avformat/rtpenc_av1: bound OBU size in the keyframe search loop
 avformat/gopher: Fix CRLF injection
 avformat/rtpenc_vc2hq: reject data units larger than the RTP payload buffer
 avformat/dashdec: reject a negative fragment index
 avformat/hevc: reject hvcC NAL arrays that overflow the 16-bit count
 avformat/mpegenc: reject stream counts that overflow the system header
 avformat/mpegenc: pass buffer size into put_system_header()
 avformat/librist: honor the caller buffer size in librist_read
 avformat/scd: reject zero-channel tracks
 avcodec/dolby_e: Add error recovery when parse_mantissas run out of bits
 avfilter/af_pan: check the id of named input channels before use
 swscale: avoid overflow in fast bilinear edge handling
 avformat/shared: Use correct printf specifier
 Revert "lavfi/bwdif: fix heap-buffer-overflow with small height videos"
 avfilter/vf_bwdif: fix line boundary checks for >8 bits content
 avformat/rawutils: reject raw RGB frames that do not fit an AVPacket
 avcodec/nvenc: write AV1 timecode metadata in AV1 syntax
 avcodec/utils: add ff_alloc_timecode_metadata_av1()
 avcodec/utils: factor the timecode fields out of ff_alloc_timecode_sei
 vulkan_encode_av1: set primary_ref_frame to a reference name, not a slot
 avformat/mov: reject a trun sample count the input cannot hold
 RELEASE_NOTES: Based on the version from 8.0
 avformat/mp3enc: fix underflow of the LAME encoder delay
 avformat/os_support: fix return value of win32_rename
 vulkan_encode: fix leak and swallowed errors in init_base_units()
 avfilter/dnn: fix async teardown race condition in all backends
 avcodec/tiff: reject inflate output shorter than the strip
 avformat/dashdec: check NULL pointer before use str_end_offset
 avformat/dashdec: check NULL pointer of av_strtok value before use it
 avfilter/vf_scale_cuda: fix non-scaling format conversion
 fftools/opt_common: fix format string bug in print_program_info
 avformat/dashdec: fix integer truncation in calc_max_seg_no()
 swscale/x86: fix SIGILL in u8 SCALE on SSE4-only CPUs
 avdevice/android_camera: fix OOB read in metadata parsing
 avformat/dashdec: don't stop at the first input EOF
 avformat/iamf_parse: check that num_sub_mixes and num_audio_elements in Mix Presentations are not zero
 avformat/iamf_parse: bound the output mix gain duration by the audio elements
 avcodec/cbs_h266: size vps_direct_ref_layer_flag for the full layer range
 avcodec/vulkan/ffv1_dec_setup: act on the slice header rejection
 avcodec/ffv1dec: reject a remap that produces zero entries
 avcodec/ffv1dec: mark the slice damaged when its remap fails
 avcodec/vulkan/ffv1_dec_setup: bound the fltmap write
 avcodec/vulkan/ffv1_dec_setup: test mul_count as unsigned
 avcodec/vulkan/ffv1_dec_setup: reject a remap that produces zero entries
 avcodec/pgssubdec: always give an output rect a palette
 scale_d3d11: Fix hw_frame_ctx reference leak
 avcodec/cfhd: reject transform-2 output wider than the plane
 avformat/rtsp: clear authentication on cross-origin redirects
 avcodec/dovi_rpuenc: normalize vdr_dm_metadata_present to 0/1
 avcodec/dovi_rpuenc: validate vdr_rpu_id from the input metadata
 avcodec/bsf/dovi_rpu: handle update_rpu() returning no RPU
 avcodec/dovi_rpudec: bound num_x/y_partitions
 avcodec/dovi_rpuenc: validate the data mapping before generation
 avfilter/af_arnndn: pad the DCT input buffers to the read length
 doc/nut.texi: point at the latest spec in the git repository
 avformat/mov: bound sgpd sync entry_count by the atom size
 avcodec/rscc: do not leave uninitilized data when the input is too short
 avcodec/dvbsub_parser: avoid signed overflow in the capacity check
 avformat/tls_openssl: bind peer identity for numeric-IP verify
 avformat/codec2: avoid integer overflow in packet size and duration
 avfilter/vf_xpsnr: avoid a zero block size on small frames
 avcodec/cbs_av1: pad the ITU-T T.35 payload buffer
 avcodec/screenpresso: reject deflate output shorter than the frame
 avformat/hls: Enforce protocol checks when opening child playlists
 avformat/hlsenc: Fix heap buffer overflow in parse_playlist()
 avformat/hlsenc: Handle extensionless URIs in extract_segment_number()
 avfilter/vf_lut3d: do not compute size*size before the size is validated
 avfilter/vf_hqdn3d: support dynamic frame sizes
 avfilter/vf_hqdn3d: reject unsupported frame parameter changes
 avcodec/bsf/truehd_core: clear profile value on init()
 avcodec/bsf/eac3_core: clear profile value on init()
 avformat/iamf_parse: fix inverted subblock duration validation
 avcodec/get_buffer: use frame pixel format instead of context
 avformat/lcevc: add a log context parameter to all functions
9.0
 Extend AMF Color Converter (vf_vpp_amf) HDR capabilities
 LCEVC track muxing support in MP4 muxer
 Playdate video encoder and muxer
 Add v360_vulkan filter
 HE-AAC 960 decoding (DAB+)
 transpose_cuda filter
 Add AMF Frame Rate Converter (vf_frc_amf) filter
 SMPTE 2094-50 metadata support and passthrough
 ProRes RAW VideoToolbox hwaccel
 APV Vulkan hwaccel
 Animated WebP decoder
 Animated WebP demuxer
 Remove CELT decoding support (doesn't affect Opus CELT)
 Remove ogg/celt parsing
 Bitstream filter to split Dolby Vision multi-layer HEVC
 Add AMF hardware memory mapping support.
 ONNX Runtime DNN backend with GPU execution provider support
 Remove deprecated NVENC options and support for pre-11.1 SDK versions

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 config/rootfiles/packages/ffmpeg | 29 +++++++++++++++--------------
 lfs/ffmpeg                       |  6 +++---
 2 files changed, 18 insertions(+), 17 deletions(-)

diff --git a/config/rootfiles/packages/ffmpeg b/config/rootfiles/packages/ffmpeg
index fff978cd6..dbb54ad36 100644
--- a/config/rootfiles/packages/ffmpeg
+++ b/config/rootfiles/packages/ffmpeg
@@ -121,6 +121,7 @@ usr/bin/ffprobe
 #usr/include/libavutil/pixfmt.h
 #usr/include/libavutil/random_seed.h
 #usr/include/libavutil/rational.h
+#usr/include/libavutil/raw_color_params.h
 #usr/include/libavutil/rc4.h
 #usr/include/libavutil/refstruct.h
 #usr/include/libavutil/replaygain.h
@@ -153,26 +154,26 @@ usr/bin/ffprobe
 #usr/include/libswscale/version.h
 #usr/include/libswscale/version_major.h
 #usr/lib/libavcodec.so
-usr/lib/libavcodec.so.62
-usr/lib/libavcodec.so.62.28.102
+usr/lib/libavcodec.so.63
+usr/lib/libavcodec.so.63.1.101
 #usr/lib/libavdevice.so
-usr/lib/libavdevice.so.62
-usr/lib/libavdevice.so.62.3.102
+usr/lib/libavdevice.so.63
+usr/lib/libavdevice.so.63.1.101
 #usr/lib/libavfilter.so
-usr/lib/libavfilter.so.11
-usr/lib/libavfilter.so.11.14.102
+usr/lib/libavfilter.so.12
+usr/lib/libavfilter.so.12.1.101
 #usr/lib/libavformat.so
-usr/lib/libavformat.so.62
-usr/lib/libavformat.so.62.12.102
+usr/lib/libavformat.so.63
+usr/lib/libavformat.so.63.1.101
 #usr/lib/libavutil.so
-usr/lib/libavutil.so.60
-usr/lib/libavutil.so.60.26.102
+usr/lib/libavutil.so.61
+usr/lib/libavutil.so.61.1.101
 #usr/lib/libswresample.so
-usr/lib/libswresample.so.6
-usr/lib/libswresample.so.6.3.102
+usr/lib/libswresample.so.7
+usr/lib/libswresample.so.7.1.101
 #usr/lib/libswscale.so
-usr/lib/libswscale.so.9
-usr/lib/libswscale.so.9.5.102
+usr/lib/libswscale.so.10
+usr/lib/libswscale.so.10.1.101
 #usr/lib/pkgconfig/libavcodec.pc
 #usr/lib/pkgconfig/libavdevice.pc
 #usr/lib/pkgconfig/libavfilter.pc
diff --git a/lfs/ffmpeg b/lfs/ffmpeg
index a2bc80aad..a366ed419 100644
--- a/lfs/ffmpeg
+++ b/lfs/ffmpeg
@@ -26,7 +26,7 @@ include Config
 
 SUMMARY	   = Library for working with various multimedia formats
 
-VER        = 8.1.2
+VER        = 9.0.1
 
 THISAPP    = ffmpeg-$(VER)
 DL_FILE    = $(THISAPP).tar.xz
@@ -34,7 +34,7 @@ DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
 PROG       = ffmpeg
-PAK_VER    = 24
+PAK_VER    = 25
 
 DEPS       = sdl2 lame libvorbis
 
@@ -52,7 +52,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = b37849fd89cdbc336700227c804d7642e0d2e4024359d15f4c3659cd41465145946b362fb61e0dc0141730f1d0352e2a2bf33d513213b2b3b68978be766b5914
+$(DL_FILE)_BLAKE2 = 85b3b175211dfc013ae5df3ffd2bf2a1fd68f682f6b63d1a1a3aa431b7a8b5ef15c41108a6fa1ef2b15e6677f182ab02e48e0b56d3f301ef8e1777a473e8dd82
 
 install : $(TARGET)
 
-- 
2.55.0

[PATCH 2/5] shairport-sync: Update to version 5.5.1

[Adolf Belka]

- Update from version 4.3.7 to 5.5.1
- No change in rootfile
- shairport-sync had to be updated to version 5.5.1 to be able to build with ffmpeg-9.0.1
   present.
- --with-apple-alac is deprecated ddue to security concerns and will be removed in a
   future release. With this option selected you cannot have --with-airplay-2
- shairport-sync from version 5.0 onwards has been fully integrated with ffmpeg and it
   is recommended to use ffmpeg for alac decoding in place of apple-alac
- The alac version that was available had not been updated for 10 years.
- So --with-apple-alac is removed and replaced with --with-ffmpeg
- alac is removed with another patch in this set and so it is removed from the
   shairport-sync dependecies list
- Although there are no CVE's in the changelogs, several of the updates have security
   fixes applied
- Changelog
5.5.1
The version number has been bumped from 5.2.3 to 5.5.1 to harmonise version numbers
	across release and development branches, so that it can be stated that "these
	security updates apply to any version of Shairport Sync from 5.5 onwards".
(This version is identical to Version 5.5, but has been bumped to 5.5.1 to invoke the
	Docker image-generation workflow.)
Security Updates
This update contains important security updates:
    An AirPlay 2 client could crash Shairport Sync by sending a SETUP request whose
	timingPeerInfo.Addresses array contains a non-string element. Fixed by
	improved checking.
    The AirPlay-2 SETUP shk (session key) value's length was not validated, so a
	short shk could cause an out-of-bounds read, potentially leaking information
	or causing a crash. Fixed by improved validation.
    On a classic-AirPlay session using the (deprecated) Hammerton decoder that
	negotiates an uncompressed PCM session, the audio buffer is sized for exactly
	one packet, but the decode copy was bounded by the received packet length and
	was not checked against the allocation. Thus, a single oversized UDP audio
	packet could overflow the heap with attacker-controlled data. Fixed by extra
	bounds checking.
    Note that use of the Hammerton decoder continues to be deprecated for security
	reasons.
    A unauthenticated client on an AirPlay 2 receiver could overflow a stack buffer
	by sending an RTSP request with an unrecognised method and a large body.
	Fixed by sizing the buffer correctly.
    A remote, unauthenticated client could crash the daemon with a two-byte pairing
	message. Fixed by improved operand checking.
    A number of updates have been made for classic-AirPlay builds that use the
	(deprecated) tinysvcmdns mDNS library.
    Note that the tinysvcmdns library is no longer maintained upstream, and its use
	is strongly deprecated for security reasons.
5.2.3
Bug Fix
    Fix a memory allocation bug in the convolution code. This occurred at high output
	rates, e.g. 192,000 frames per second.
5.2.2.2
Enhancement
    If the output rate is different to the input rate (e.g. 48,000 vs 44,100), the
	deepest output bit depth will be chosen so that the transcoder has the
	maximum dynamic range available to minimise transcoding inaccuracies.
Bug Fixes
    Fixed a bug whereby the audio backend latency offset was mishandled in AirPlay 2
	operation.
    Background: the audio_backend_latency_offset_in_seconds in the general section of
	the configuration file allows you to delay or advance the output by a fixed
	amount relative to the exact synchronisation time. It can be used, for
	example, to delay the audio slightly so that it synchronises with audio
	coming from another device that is delayed by internal processing.
    The bug was that the latency offset value was being used before the frame rate of
	the incoming audio was properly set, resulting in an incorrect calculation of
	the number of frames to offset.
    Many thanks to prhodey for discovering and investigating the problem and for a
	PR that fixes the problem for Buffered Audio streams. An adjustment has also
	been made to the treatment of Realtime streams.
    Fixed a subtle output format selection bug thanks to nicolas314's report.
    The bug would occur only in specific circumstances when searching for a suitable
     output rate and format to match the input. Rather ironically, it arose from an
     attempt to maximise audio fidelity, as follows:
        If it can be determined from the settings that Shairport Sync ("SPS") does
	 not have to modify the audio, e.g. by changing volume, then SPS will look
	 for an output format with the exact same rate and format as the input, so
	 that audio passes through SPS without alteration of any kind.
        Unfortunately, due to the bug, if it failed to find an exact match, SPS would
	 start searching at a different output rate.
        The bug only showed up when it could be determined that no modification of
	 the audio was to be performed. So the bug only occured if
	 ignore_volume_control was set to yes and the output device could not exactly
	 match the input format.
    The fix means that if SPS fails to find an exact format match, it will now look
	for another format at the same rate before searching at other rates.
    In addition, to be sure that no further audio processing is needed, SPS checks
	to ensure that neither convolution not loudness are enabled.
Documentation Update
    Update the README reference to the MPRIS specification to the latest version.
	Thanks to Dmitry Batin for the PR.
Building Enhancement
    Remove the explicit - for xxd to read from STDIN. It's not necessary, and
	removing it makes it easier to package Shairport Sync on other build systems,
	such as OpenWrt. Thanks to kel-mo for the PR.
Dependabot Updates
    Dependabout updates were made to some of the tools in the CI / GitHub build system.
5.2.2 and 5.2.2.2
Identical to 5.2.2.2 The extra point releases were created in order to debug and fix
	a GitHub Actions problem.
5.2
New Features and Enhancements
    A new MQTT command, queue_next, has been added -- thanks to Scott Simon for the PR:
    A new queue_next MQTT command enqueues a track by its Persistent ID
	(hexadecimal track_id), for example: queue_next 316a7653186B6917. The command
	is sent as a remote control command via DACP to the player.
    Please note that, like all other remote control commands, this works for Classic
	AirPlay only.
    Added a long-overdue exit handler to enable Shairport Sync to exit cleanly — that
	is, to attempt to clean everything up, e.g. open files, sockets, devices,
	threads, etc. before exit. If cleanup isn’t finished after one second, exit
	will occur unconditionally.
    The new exit handler is now used for normal exit, abnormal exit after fatal
	errors and for quit requests from the D-Bus and MPRIS interfaces.
Bug Fixes
    Metadata: Restored the previous way of receiving metadata, which was
	inadvertently removed, for better compatibility for older users of metadata.
	A temporary new option in the diagnostics section of the configuration file
	allows you to opt for the newer plist-based metadata, which is considerably
	richer but not yet integrated into the D-Bus or MPRIS interfaces. Thanks to
	Léo for the report.
    Convolution & Loudness: Fixed a number of bugs in the convolution and loudness
	code. The bugs were due to mixing up input and output rates and channel
	counts. If the input and output rates and channel counts were identical, no
	problem. But if rates were different, the wrong finite impulse response
	filter would be loaded. Many thanks to Christopher Wawak for the report and
	follow-up.
    MQTT: Fixed byte order of the track_id published over MQTT.
    Fixed a very low-level mutex-locking error that interfered with debugging.
    Unfixable Error Hang: Fixed a hang when an unfixable error occurred. When an
	unfixable error occurs without an unfixable error handler installed, the
	mutex protecting Shairport Sync’s alsa backend is now unlocked to permit a
	clean exit. Thanks to timg7 for the report.
    Updated audio_sndio.c to remove some harmless compiler warnings.
Deprecations
    The log-to-syslog command line option and the log_output_to setting in the
	diagnostics part of the configuration are obsolete and are now ignored.
Documentation Fix
    Fixed a broken link to CONFIGURATION FLAGS.md from ADVANCED TOPICS. Thanks to
	Adrián Reyes for the PR.
    Updated the BUILD guide to include gcrypt in the list of packages needed when
	building for FreeBSD / AirPlay 2.
Dependabot Updates
    Merged in a number of CI-related Dependabot updates.
5.1
Security Fix
    Fixed Out-Of-Bounds reads and a potential infinite loop in TLV and DMAP parsers.
	Thanks to TristanInSec for two reports and the PR to fix it.
Remote Control is Back for Classic AirPlay!
An error that broke DACP signalling has been fixed. Messages (e.g. “play”, “pause”,
	“next”, etc.) sent to Shairport Sync via the D-Bus, MPRIS or MQTT interfaces
	are now correctly forwarded to the client. This works for classic AirPlay only.
New Metadata Build Configuration flags
    The metadata pipe and multicast interfaces are no longer included automatically
     when metadata support is included in the build configuration. To include them,
     use the respective new configuration flags listed below:
        —with-metadata-pipe
        —with-metadata-multicast
New Features
    AirPlay 2 Password: You can now set a password for AirPlay 2 as well as classic
	AirPlay.
    Until now, you could only set a password on a classic AirPlay service. Now it
	works on AirPlay 2 connections too.
    Up to 31 channels now allowed on the output device.
    The previous limit was eight channels; if you connected to a device with more
	than eight channels, Shairport Sync was unable to use it.
    The AirPlay 2 build can now provide a pure classic AirPlay mode either by request
     or by default under the control of a new optional setting:
        You can ask the AirPlay 2 build of Shairport Sync to provide a purely classic
	 AirPlay service with a setting: --service-type=<type> on the command line,
	 or service_type = "<type>"in the general section of the configuration file.
	 The <type> can be "auto" (default), "classic" or "airplay2".
        If the service type setting is omitted or set to "auto", AirPlay 2 service
	 will be provided if NQPTP is running, and classic AirPlay service will be
	 provided if not.
More…
    Improved stability when switching players.
        When an existing session is interrupted, it is completely terminated before
	 starting the new session.
    Updated Docker base Linux image and FFmpeg libraries
        Alpine 3.23.4 and FFmpeg 8.1.
    Docker image generation for ARM V6 CPUs has been discontinued.
        Docker itself is no longer supported on ARM V6 CPUs.
    Updated sample docker-compose.yml to ask for SYS_NICE capabilities.
    Miscellaneous Bug Fixes
        Fixed incorrect signalling of the DACP port to the DACP monitor. The dapo
	 metadata, giving the DACP port number, is now sent as text, with a token of
	 ”0” when the port becomes inaccessible.
        When an immediate flush is requested, PTP clock information is reset
	 immediately to disable the use an out-of-date clock until play is resumed.
        If a TEARDOWN has a plist with a streams item, the player is stopped. If the
	 plist exists but is empty, the connection is closed immediately rather than
	 waiting for the connection to be closed by the client.
        Set Locales in Test Clients
            This allows the shairport-sync-dbus-test-client and
		shairport-sync-mpris-test-client apps to display non-ASCII characters
		correctly.
        Fix a stack overflow bug on Alpine Linux with log verbosity set to -vvv.
	 Thanks to Arthur Loureiro for the report.
        Display n/a in a statistics readout instead of the value of
	 UINT64_MAX — 18446744073709551615 — if the minimum DAC length is not available.
    User Service Installer Script Update
        Checks are now included for non-root use and for PipeWire or PulseAudio services.
    Dependabot updates.
5.0.4
Bug Fix
Fix a bug that prevents the PulseAudio backend from initialising.
5.0.3
Bump docker/login-action from 4.0.0 to 4.1.0 by @dependabot[bot] in #2183
Fix systemd unit options by @mikelei8291 in #2174
Bump docker/build-push-action from 7.0.0 to 7.1.0 by @dependabot[bot] in #2187
Improved handling of cancellation of application and of a session.
5.0.2
Enhancement
    When built for AirPlay 2, add pw=true to the Bonjour raop properties if the
	classic AirPlay password is set. This might help with Owntone compatibility.
	Thanks to janui for the suggestion.
Documentation Update
    Fixed dead link to the online man page. Thanks to CornelisJ for the report.
Bug Fix
    Update the D-Bus test client to refer to shairport_sync_get_loudness_enabled
	rather than shairport_sync_get_loudness. Thanks to flatsiedatsie for the bug
	report.
    Defer rather than delete blocks of audio that are too far into the future, and
	also check for a valid clock when checking the timing of blocks. This is to
	attempt to deal with an unexpected situation where the timing of blocks of
	incoming audio seems to suddenly jump into the distant future, as if audio
	from the skipped-over interval has been dropped.
Changes
    Turn off some currently-irrelevant debug messages by setting their level to 4,
	meaning they will never be displayed.
5.0.1
MQTT Enhancement
    A Home-Assistant-specific default_entity_id has been added to the MQTT interface.
	The deprecated object_id term will be removed in a future release. Thanks to
	Markus Reiter for the PR.
Bug Fixes
    The requirement to have the mosquitto service running on the same system if MQTT
	support is included in the build of Shairport Sync has been removed. The
	service does not, in fact, need to be running in every case.
    This reverses a change made in PR at Version 5.0-dev-161. Thanks to David Crook
	for the bug report.
    A number of compilation warnings have been fixed. Thanks to Rudi Heitbaum for the PR.
Build System Updates
    A number of dependabot-signalled build system updates are included.
5.0
New Features
    Multi-Channel and High-Resolution Audio Support
        48,000 frames per second ("48k") operation.
        48k lossless stereo support.
        5.1 and 7.1 surround sound support.
        Multi-channel and multi-rate operation on ALSA, PipeWire, PulseAudio,
	 FreeBSD, stdout and Unix pipe output backends.
    Automatic Audio Format Selection
        Flexible and controllable output format selection.
        Automatic rate, sample format, and channel count selection.
    Full FFmpeg Integration
        Support for transcoding.
        Advanced resampling capabilities.
        New audio format support.
    Enhanced Resampling
        New vernier resampling and interpolation method optimized for low-power CPUs.
        Better performance on resource-constrained devices.
    Convolution and Loudness Enhancements
        Convolution system is now multithreaded and works on stereo and multichannel
	 audio at 48k and 44.1k.
        Multiple impulse response (IR) files can now be provided via
	 convolution_ir_files setting.
        New convolution_thread_pool_size setting for multithreaded processing
	 (defaults to 1).
        Loudness processing now works with stereo and multichannel audio at 48k and
	 44.1k.
        Updated to the most recent HiFi-LoFi FFT convolver.
    MQTT Enhancements
        Added new publish_retain boolean option. When enabled, published MQTT messages
	 have the retain flag set, so the MQTT broker stores the last message per
	 topic and new subscribers receive the most recent value immediately. Thanks
	 to lululombard for PR #2142.
    D-Bus Enhancements
        Added new --dbus_default_message_bus command-line argument (can be system or
	 session) to set the default message bus for both D-Bus native service and
	 MPRIS service. For example: --dbus_default_message_bus=session.
Performance Improvements
    Improved compatibility with AirPlay 2 AutoMix and smart playlists.
    Better operation on low-power devices down to Raspberry Pi B.
    Improved efficiency on embedded systems.
    Enhanced timestamp handling for better synchronization.
    Improved sync error calculation.
    Rebuilt buffered audio processor for cleaner handling of immediate and deferred
	flush requests.
Docker Enhancements
    Reduced Docker image sizes with slimmed-down FFmpeg library.
    Removed dhclient from Docker images for smaller footprint.
Bug Fixes
    Fixed MQTT warning on service startup: Could not establish a mqtt connection. The
	startup script now correctly states that the mosquitto service is required.
	Thanks to Hugo Villeneuve for PR #2137.
    Fixed compatibility with mbedtls library version 3.4+ (present on recent Linux
	versions). Thanks to Christian Beier for finding and fixing the bug.
    Fixed PulseAudio backend so that PA_ERR_NODATA returns "No latency data yet".
	Thanks to Vladimir Shakov for the report and fix.
    Ensured old flush requests are deleted when a new play session starts. Thanks to
	saujanyashah for the report.
    Fixed format warnings on 64-bit and 32-bit systems
    Removed compilation warnings on 32-bit builds
    Improved argument checking for debug(), inform(), warn() and die() functions
    Fixed "daemon" typos throughout codebase. Thanks to Chris Boot for PR #1981.
    Added warning if a convolution impulse response file cannot be read due to bad
	path or permissions
Build System Improvements
    Unified service file with variable substitution for Avahi support, making it
	easier to add future service dependencies. Thanks to Hugo Villeneuve.
    Network interface selection now only considers interfaces that are up, running and
	not loopback interfaces. Thanks to Carl Johnson for the suggestion.
Configuration File Changes and Deprecations
    New settings: convolution_ir_files (replaces convolution_ir_file),
	convolution_enabled (replaces convolution),
	convolution_max_length_in_seconds (replaces convolution_max_length),
	loudness_enabled (replaces loudness).
    New convolution_thread_pool_size setting (defaults to 1).
    Deprecated settings: convolution_ir_file, convolution, convolution_max_length,
	loudness.
    Corresponding D-Bus methods and properties have been updated.
Deprecation Notice
    The Jack Audio and soundio backends are deprecated and will be removed in a future
	release. Consider using the updated PipeWire backend instead.
Documentation Updates
    Updated BUILD.md with latest build instructions.
    Updated AIRPLAY2.md with feature information.
    Enhanced convolution and loudness documentation.
Maintenance
    Fixed FFmpeg deprecation warnings.
    Bumped actions/checkout from 6.0.1 to 6.0.2.
    Bumped docker/login-action from 3.6.0 to 3.7.0.
    Bumped docker/build-push-action from 6.13.0 to 6.15.0.
    Bumped docker/setup-qemu-action from 3.4.0 to 3.6.0.
    Bumped docker/setup-buildx-action from 3.9.0 to 3.10.0.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 lfs/shairport-sync | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/lfs/shairport-sync b/lfs/shairport-sync
index a58a5268c..fc120ada4 100644
--- a/lfs/shairport-sync
+++ b/lfs/shairport-sync
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2025  IPFire Team  <info@ipfire.org>                     #
+# Copyright (C) 2007-2026  IPFire Team  <info@ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -26,7 +26,7 @@ include Config
 
 SUMMARY    = An AirPlay audio player
 
-VER        = 4.3.7
+VER        = 5.5.1
 
 THISAPP    = shairport-sync-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -34,9 +34,9 @@ DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
 PROG       = shairport-sync
-PAK_VER    = 17
+PAK_VER    = 18
 
-DEPS       = alac alsa avahi ffmpeg libdaemon libplist nqptp soxr
+DEPS       = alsa avahi ffmpeg libdaemon libplist nqptp soxr
 
 SERVICES   = shairport-sync
 
@@ -48,7 +48,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = 9c4013fce4c7e5c45126fc685cc2db408fd51f570d696e01ff8463756778e075a6e1728c03ac3bcaa9db7953c473965c3ac6853a2f3625bd843a02dd60c97281
+$(DL_FILE)_BLAKE2 = 7e683abeb75660d8b396eb560e092d3318c6dec892725f7e6e308cb63a0eb7b5e6d4cf482ab0cb83e47b6a051ad571c4057492c46bcea7da1e719fa5e00f095f
 
 install : $(TARGET)
 
@@ -87,7 +87,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 				--sysconfdir=/etc \
 				--with-airplay-2 \
 				--with-alsa \
-				--with-apple-alac \
+				--with-ffmpeg \
 				--with-avahi \
 				--with-libdaemon \
 				--with-ssl=openssl \
-- 
2.55.0

[PATCH 3/5] alac: Remove this addon linked to shairport-sync update

[Adolf Belka]

- With the latest shairport-sync update in this patch set, the 10 year old apple-alac
   package is no longer required. shairport-sync stopped using it due to security
   conecrn.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 config/rootfiles/packages/alac | 15 ------
 lfs/alac                       | 89 ----------------------------------
 make.sh                        |  1 -
 3 files changed, 105 deletions(-)
 delete mode 100644 config/rootfiles/packages/alac
 delete mode 100644 lfs/alac

diff --git a/config/rootfiles/packages/alac b/config/rootfiles/packages/alac
deleted file mode 100644
index 305a2c4e8..000000000
--- a/config/rootfiles/packages/alac
+++ /dev/null
@@ -1,15 +0,0 @@
-#usr/include/alac
-#usr/include/alac/ALACAudioTypes.h
-#usr/include/alac/ALACBitUtilities.h
-#usr/include/alac/ALACDecoder.h
-#usr/include/alac/ALACEncoder.h
-#usr/include/alac/EndianPortable.h
-#usr/include/alac/aglib.h
-#usr/include/alac/dplib.h
-#usr/include/alac/matrixlib.h
-#usr/lib/libalac.a
-#usr/lib/libalac.la
-#usr/lib/libalac.so
-usr/lib/libalac.so.0
-usr/lib/libalac.so.0.0.0
-#usr/lib/pkgconfig/alac.pc
diff --git a/lfs/alac b/lfs/alac
deleted file mode 100644
index ecea84b33..000000000
--- a/lfs/alac
+++ /dev/null
@@ -1,89 +0,0 @@
-###############################################################################
-#                                                                             #
-# IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2018  IPFire Team  <info@ipfire.org>                     #
-#                                                                             #
-# This program is free software: you can redistribute it and/or modify        #
-# it under the terms of the GNU General Public License as published by        #
-# the Free Software Foundation, either version 3 of the License, or           #
-# (at your option) any later version.                                         #
-#                                                                             #
-# This program is distributed in the hope that it will be useful,             #
-# but WITHOUT ANY WARRANTY; without even the implied warranty of              #
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
-# GNU General Public License for more details.                                #
-#                                                                             #
-# You should have received a copy of the GNU General Public License           #
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
-#                                                                             #
-###############################################################################
-
-###############################################################################
-# Definitions
-###############################################################################
-
-include Config
-
-SUMMARY    = Apple Lossless Audio Codec
-
-VER        = 0.0.7
-
-THISAPP    = alac-$(VER)
-DL_FILE    = $(THISAPP).tar.gz
-DL_FROM    = $(URL_IPFIRE)
-DIR_APP    = $(DIR_SRC)/$(THISAPP)
-TARGET     = $(DIR_INFO)/$(THISAPP)
-PROG       = alac
-PAK_VER    = 1
-
-DEPS       =
-
-SERVICES   =
-
-###############################################################################
-# Top-level Rules
-###############################################################################
-
-objects = $(DL_FILE)
-
-$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-
-$(DL_FILE)_BLAKE2 = 763e8d93a2ff0445cc260d6a631bd6468fc35b3ac4a5a1fed8f412bce53b6960d57aad43cadb693d0d069a18ffe2876e0a6a85e814e1b5f5846dc9cfa9ceba07
-
-install : $(TARGET)
-
-check : $(patsubst %,$(DIR_CHK)/%,$(objects))
-
-download :$(patsubst %,$(DIR_DL)/%,$(objects))
-
-b2 : $(subst %,%_BLAKE2,$(objects))
-
-dist:
-	@$(PAK)
-
-###############################################################################
-# Downloading, checking, b2sum
-###############################################################################
-
-$(patsubst %,$(DIR_CHK)/%,$(objects)) :
-	@$(CHECK)
-
-$(patsubst %,$(DIR_DL)/%,$(objects)) :
-	@$(LOAD)
-
-$(subst %,%_BLAKE2,$(objects)) :
-	@$(B2SUM)
-
-###############################################################################
-# Installation Details
-###############################################################################
-
-$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
-	@$(PREBUILD)
-	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE)
-	cd $(DIR_APP) && autoreconf -vfi
-	cd $(DIR_APP) && ./configure --prefix=/usr
-	cd $(DIR_APP) && make $(MAKETUNING)
-	cd $(DIR_APP) && make install
-	@rm -rf $(DIR_APP)
-	@$(POSTBUILD)
diff --git a/make.sh b/make.sh
index 37f01c1a2..cf082c6b0 100755
--- a/make.sh
+++ b/make.sh
@@ -1922,7 +1922,6 @@ build_system() {
 	lfsmake2 observium-agent
 	lfsmake2 ebtables
 	lfsmake2 faad2
-	lfsmake2 alac
 	lfsmake2 ffmpeg
 	lfsmake2 vdr
 	lfsmake2 vdr_streamdev
-- 
2.55.0

[PATCH 4/5] minidlna: bump version due to ffmpeg sobump

[Adolf Belka]

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 lfs/minidlna | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lfs/minidlna b/lfs/minidlna
index 9915f4df4..3241497f5 100644
--- a/lfs/minidlna
+++ b/lfs/minidlna
@@ -34,7 +34,7 @@ DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
 PROG       = minidlna
-PAK_VER    = 18
+PAK_VER    = 19
 
 DEPS       = ffmpeg flac libexif libid3tag libogg
 
-- 
2.55.0

[PATCH 5/5] mpd: bump version due to ffmpeg sobump

[Adolf Belka]

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 lfs/mpd | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lfs/mpd b/lfs/mpd
index 7c8c32f33..7b2eb2a4b 100644
--- a/lfs/mpd
+++ b/lfs/mpd
@@ -34,7 +34,7 @@ DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/${THISAPP}
 TARGET     = $(DIR_INFO)/$(THISAPP)
 PROG       = mpd
-PAK_VER    = 50
+PAK_VER    = 51
 # SUP_ARCH   = aarch64 x86_64
 
 DEPS       = alsa avahi faad2 ffmpeg flac lame libmad libshout libogg libid3tag libvorbis opus soxr fmt
-- 
2.55.0