[PATCH] aprutil: Update to version 1.6.6

[PATCH] aprutil: Update to version 1.6.6

[Adolf Belka]

- Update from version 1.6.5 to 1.6.6
- Update of rootfile
- Although there are only two line entries in the changelog another part of the website
   says "The main changes in this release are concerned with the third-party
   dependencies, including unbundling expat, and building with up-to-date versions of
   libraries such as OpenSSL and MySQL."
- So the recommendation is to upgrade and hence I have provided this patch submission.
   However, as far as I can tell we have explicitly told the configure to use expat and
   openssl that we have built in IPFire and not to use the bundled packages so it may not
   make any difference for us.
- Changelog
1.6.6
  *) Fix crypto/apr_passwd.c compilation errors on older systems. PR 70283.
  *) Fix crashes in apr_crypto_get_block_key_types() with default cmake builds on
     Windows. PR 70260.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 config/rootfiles/common/aprutil | 2 +-
 lfs/aprutil                     | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/config/rootfiles/common/aprutil b/config/rootfiles/common/aprutil
index 672c5a692..44e1bb55e 100644
--- a/config/rootfiles/common/aprutil
+++ b/config/rootfiles/common/aprutil
@@ -48,5 +48,5 @@ usr/lib/apr-util-1/apr_dbm_gdbm.so
 #usr/lib/libaprutil-1.la
 #usr/lib/libaprutil-1.so
 usr/lib/libaprutil-1.so.0
-usr/lib/libaprutil-1.so.0.6.5
+usr/lib/libaprutil-1.so.0.6.6
 #usr/lib/pkgconfig/apr-util-1.pc
diff --git a/lfs/aprutil b/lfs/aprutil
index 39761715c..fb06aad4e 100644
--- a/lfs/aprutil
+++ b/lfs/aprutil
@@ -25,7 +25,7 @@
 
 include Config
 
-VER        = 1.6.5
+VER        = 1.6.6
 
 THISAPP    = apr-util-$(VER)
 DL_FILE    = $(THISAPP).tar.bz2
@@ -44,7 +44,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = ee11e45f0029b336c80536f0b98b48f044229d5b9d8669471a1f0641eee8aa6ddbd8f2249ce6116294dc3d3c5b8b939532c366e6208dafe325eeba1db2603300
+$(DL_FILE)_BLAKE2 = b4062cbdf8ef9ba1f83879695eb16fb7344760c0c1642365353f2c225bb3fc2fbb6389fd08edb594d7c6fa62492735045d652db969e52262994830e70e3e92dc
 
 install : $(TARGET)
 
-- 
2.56.0

[PATCH] core207: Ship aprutil

[Adolf Belka]

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 config/rootfiles/core/207/filelists/aprutil | 1 +
 1 file changed, 1 insertion(+)
 create mode 120000 config/rootfiles/core/207/filelists/aprutil

diff --git a/config/rootfiles/core/207/filelists/aprutil b/config/rootfiles/core/207/filelists/aprutil
new file mode 120000
index 000000000..999f9f84b
--- /dev/null
+++ b/config/rootfiles/core/207/filelists/aprutil
@@ -0,0 +1 @@
+../../../common/aprutil
\ No newline at end of file
-- 
2.56.0

[PATCH] core207: Ship fribidi

[Adolf Belka]

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 config/rootfiles/core/207/filelists/fribidi | 1 +
 1 file changed, 1 insertion(+)
 create mode 120000 config/rootfiles/core/207/filelists/fribidi

diff --git a/config/rootfiles/core/207/filelists/fribidi b/config/rootfiles/core/207/filelists/fribidi
new file mode 120000
index 000000000..1a17a37c9
--- /dev/null
+++ b/config/rootfiles/core/207/filelists/fribidi
@@ -0,0 +1 @@
+../../../common/fribidi
\ No newline at end of file
-- 
2.56.0

[PATCH] core207: Ship kmod

[Adolf Belka]

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 config/rootfiles/core/207/filelists/kmod | 1 +
 1 file changed, 1 insertion(+)
 create mode 120000 config/rootfiles/core/207/filelists/kmod

diff --git a/config/rootfiles/core/207/filelists/kmod b/config/rootfiles/core/207/filelists/kmod
new file mode 120000
index 000000000..0020e197e
--- /dev/null
+++ b/config/rootfiles/core/207/filelists/kmod
@@ -0,0 +1 @@
+../../../common/kmod
\ No newline at end of file
-- 
2.56.0

[PATCH] core207: Ship libjpeg

[Adolf Belka]

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 config/rootfiles/core/207/filelists/libjpeg | 1 +
 1 file changed, 1 insertion(+)
 create mode 120000 config/rootfiles/core/207/filelists/libjpeg

diff --git a/config/rootfiles/core/207/filelists/libjpeg b/config/rootfiles/core/207/filelists/libjpeg
new file mode 120000
index 000000000..3b1a782fb
--- /dev/null
+++ b/config/rootfiles/core/207/filelists/libjpeg
@@ -0,0 +1 @@
+../../../common/libjpeg
\ No newline at end of file
-- 
2.56.0

[PATCH] core207: Ship nano

[Adolf Belka]

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 config/rootfiles/core/207/filelists/nano | 1 +
 1 file changed, 1 insertion(+)
 create mode 120000 config/rootfiles/core/207/filelists/nano

diff --git a/config/rootfiles/core/207/filelists/nano b/config/rootfiles/core/207/filelists/nano
new file mode 120000
index 000000000..2f07279c0
--- /dev/null
+++ b/config/rootfiles/core/207/filelists/nano
@@ -0,0 +1 @@
+../../../common/nano
\ No newline at end of file
-- 
2.56.0

[PATCH] fribidi: Update to version 1.0.18

[Adolf Belka]

- Update from version 1.0.17 to 1.0.18
- No change in rootfile
- Although there are no CVE's specified, the changelog does mention security fixes
   coming from an automated Anthropic OSS Scanner.
- Changelog
1.0.18
	* Security and robustness fixes found by an automated scan (Anthropic's
	  OSS Scanner):
	  - fribidi_remove_bidi_marks(): fixed an out-of-bounds write before the
	    caller's map when the position maps returned by one call are passed to
	    a second call. The maps it returns are now correct, and removed
	    characters are -1.
	  - Fixed unchecked memory allocations in fribidi_reorder_line(),
	    fribidi_log2vis() and the bracket pairing code, which could crash
	    when memory ran out instead of returning failure.
	  - Fixed an out-of-bounds read in the CapRTL decoder on platforms where
	    plain char is unsigned (e.g. aarch64, arm, ppc64le, s390x).
	  - Fixed quadratic running time on paragraphs made of many back-to-back
	    isolates, and on deeply nested isolates containing brackets (N0).
	* Fixed a stack buffer overflow in the CapRTL/UTF-8 output of fribidi and
	  fribidi-caprtl2utf8, and an integer overflow in the run-pool allocation
	  on 32-bit platforms.
	* Fixed paragraph direction detection to reset isolates at paragraph
	  boundaries.
	* Bidi fixes to match UAX #9 more closely. These can change the output for
	  unusual input:
	  - Overflow isolates are no longer treated as valid isolates (X5a-X5c),
	    and PDF handling checks the overflow counts first (X7).
	  - Bracket pairs (BD16/N0) no longer pair across isolates, and a full
	    bracket stack no longer stops pairing outside its isolating run
	    sequence.
	* fribidi_unicode_to_charset() now null-terminates the output for an
	  unknown character set.
	* Added regression tests and a fuzzing seed.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 lfs/fribidi | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lfs/fribidi b/lfs/fribidi
index f215cc0ce..29e43050e 100644
--- a/lfs/fribidi
+++ b/lfs/fribidi
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 1.0.17
+VER        = 1.0.18
 
 THISAPP    = fribidi-$(VER)
 DL_FILE    = $(THISAPP).tar.xz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = 5e2fdef3c47e12af85b2e8d7a9d421a3e9a0f1a92e36bee267a45960c8f3cdc0628011d301d9f0f02ce68bf7007ad14fa4520a41da4a8e3d09483b5e50e83a57
+$(DL_FILE)_BLAKE2 = 7e4d34e860ae46ee3ed1c9096903981a88f515fbb175d8e7f924a6053f86942d549101990e1c05dcf3fdd4a4b65efae7831a2e7f99cb7bfcc5d7ab9b5c4f2137
 
 install : $(TARGET)
 
-- 
2.56.0

[PATCH] kmod: Update to version 34.3

[Adolf Belka]

- Update from version 34.2 to 34.3
- No change in rootfile
- Changelog
34.3
       shared: util.c: fix buffer overflow in alias_normalize()
       testsuite: fix dirty rootfs error message
       libkmod: return ENOMEM when strbuf_pushchar(s) fails
       man/modprobe.8: use MODULE_DIRECTORY as applicable
       scripts/sanitizer-env.sh: remove incorrect $CC quotes
       man/modprobe.8: document --remove-holders
       man/modprobe.8: document --show-exports
       tools/modprobe: Fix odd --remove-holders behavior
       ci: Fix alpine setup
       kmod 34.3
       util: Use const variable type in mkdir_parents
       libkmod: fix type confusion in kmod_module_get_sections() error path
       libkmod: Fix open file which some char device
       tools/rmmod: fix garbled error message
       libkmod: Fix dependency count in kmod_module_parse_depline()

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 lfs/kmod | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lfs/kmod b/lfs/kmod
index de181c2a2..e33d2d03d 100644
--- a/lfs/kmod
+++ b/lfs/kmod
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2025  IPFire Team  <info@ipfire.org>                     #
+# Copyright (C) 2007-2026  IPFire Team  <info@ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 34.2
+VER        = 34.3
 
 # https://www.kernel.org/pub/linux/utils/kernel/kmod/
 
@@ -42,7 +42,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = 73e7664ef882f5d17985230797d619716b52adfbd39761579a375cdda1f516a0e120b8e3a753983d44b4cff08d3109737aca0b19283549c53a6cc2772f7ae812
+$(DL_FILE)_BLAKE2 = 69d90a912fc9176f6205ce0ce75c71cbbc179a27739ba671a0f5bc2ad7fa1c0f8ff2dcf52dccd0e6990ffa8b0373290257559b817fbdfa18450df74b05b93f69
 
 install : $(TARGET)
 
-- 
2.56.0

[PATCH] libarchive: Update to version 3.8.11

[Adolf Belka]

- Update from version 3.8.10 to 3.8.11
- Update of rootfile
- Changelog
3.8.11
	This is a security and bugfix release. The only changelog provided is a link to
	 the commit diff between 3.8.11 and 3.8.10
	 https://github.com/libarchive/libarchive/compare/v3.8.10...v3.8.11

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 config/rootfiles/common/libarchive | 2 +-
 lfs/libarchive                     | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/config/rootfiles/common/libarchive b/config/rootfiles/common/libarchive
index 1589c132e..c384a28e2 100644
--- a/config/rootfiles/common/libarchive
+++ b/config/rootfiles/common/libarchive
@@ -7,7 +7,7 @@
 #usr/lib/libarchive.la
 #usr/lib/libarchive.so
 usr/lib/libarchive.so.13
-usr/lib/libarchive.so.13.8.10
+usr/lib/libarchive.so.13.8.11
 #usr/lib/pkgconfig/libarchive.pc
 #usr/share/man/man1/bsdcat.1
 #usr/share/man/man1/bsdcpio.1
diff --git a/lfs/libarchive b/lfs/libarchive
index 9fd5bc510..c5b8f47e7 100644
--- a/lfs/libarchive
+++ b/lfs/libarchive
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 3.8.10
+VER        = 3.8.11
 
 THISAPP    = libarchive-$(VER)
 DL_FILE    = $(THISAPP).tar.xz
@@ -41,7 +41,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = 70cd55ceb3e7ac39f3f463105e0929b7e160f5a78b8266a22a043300713933be6d63175811d19f997f48a1a0d0c43197df426fe9fb30b40af4a28bc3eb4f41bd
+$(DL_FILE)_BLAKE2 = 249e4abc264a03a323c4216e60eb8c4dc9f480056ba832b84902ca92409076653b2b92bbce1b8eae149a73dfaaf51c178c7ed546dcceebca1996f7a53a64a3a1
 
 install : $(TARGET)
 
-- 
2.56.0

[PATCH] libjpeg: Update to version 3.2.1

[Adolf Belka]

- Update from version 3.2.0 to 3.2.1
- No change in rootfile
- 1 CVE fix
- Changelog
3.2.1
	1. Fixed a regression introduced by 3.2 beta1[9] that broke Un*x builds in
	 which position-independent code (PIC) was not enabled for static libraries.
	 This issue could be worked around by explicitly setting the
	 `CMAKE_POSITION_INDEPENDENT_CODE` CMake variable or using a toolchain, such as
	 the ones provided by Ubuntu, that automatically enables PIC.
	2. The RISC-V Vector (RVV) forward DCT modules now use strided segment load
	 intrinsics to simultaneously load sample rows from memory and transpose them
	 into columns, as well as multiply-accumulate intrinsics where appropriate.
	 When using the accurate integer DCT algorithm, RGB-to-baseline JPEG compression
	 is approximately 10-17% (avg. 13%) faster (relative to libjpeg-turbo 3.2.0)
	 with GCC 14 and 1-8% (avg. 4%) faster with Clang 20.  (Tested on a 1.6 GHz Ky
	 X1 CPU.  Actual mileage may vary.)
	3. Symbols from the in-tree zlib and libspng implementations introduced by
	 3.2 beta1[9] are now hidden, which prevents the symbols from being exposed in
	 downstream shared libraries and applications that link with the static
	 TurboJPEG API library.  Symbols from the in-tree zlib implementation are now
	 also renamed, which prevents downstream shared libraries and applications that
	 link with the static TurboJPEG API library from accidentally calling the
	 in-tree zlib implementation when they intend to call the system-supplied zlib
	 implementation.
	4. Fixed an integer overflow and subsequent buffer overrun that occurred when
	 attempting to use `tj3LoadImage12()` or `tj3LoadImage16()` from a 32-bit build
	 of libjpeg-turbo to load a packed-pixel image with more than 2^31 components.
	5. Fixed a division-by-zero error (CVE-2026-75466) that occurred when
	 attempting to load a non-grayscale indexed-color PNG image using
	 `tj3LoadImage*()` if the pixel format of the packed-pixel buffer was
	 unspecified (`TJPF_UNKNOWN`.)
	6. Fixed an issue whereby `tj3DecompressToYUV*()` produced incorrect
	 chrominance values when decompressing a 4:2:0, 4:1:0, or 2:4 JPEG image with
	 the "fast" IDCT algorithm and a scaling factor of 1/2.  (In other words,
	 `TJPARAM_FASTDCT` was not ignored as it should be when decompression scaling is
	 enabled.)
	7. Fixed a buffer overrun and subsequent segfault that occurred on certain
	 platforms when attempting to partially decompress a specially-crafted 4:2:0
	 JPEG image using the merged (non-fancy) upsampling algorithm with the
	 libjpeg-turbo SIMD extensions disabled and a cropping region that would have
	 caused any of the component planes to be cropped to a width of 1 or 2 samples.
	8. Hardened the libjpeg API against hypothetical applications that may
	 erroneously attempt to decompress a full-color 12-bit-per-sample JPEG image
	 with both one-pass color quantization and RGB565 color conversion enabled.
	 This could have caused a buffer overrun in one of the quantizer's color index
	 arrays.  The buffer overrun did not likely pose a security risk, since an
	 application that abused the API in the aforementioned manner could never work
	 properly.
	9. Fixed issues in `jpeg*_skip_scanlines()` whereby, when skipping certain
	 groups of scanlines while using a non-fancy (merged or plain) upsampling
	 algorithm with a vertical sampling factor greater than 1, the wrong number of
	 scanlines were skipped and/or skipped scanlines were returned in subsequent
	 calls to `jpeg*_read_scanlines()`.
	10. Hardened the TurboJPEG API against hypothetical applications that may
	 erroneously pass an invalid image to `tj3DecompressHeader()`, ignore a fatal
	 error thrown by that function, and attempt to call the function again with a
	 valid image.  Under certain circumstances, this could have caused the values of
	 `TJPARAM_JPEGWIDTH` and `TJPARAM_JPEGHEIGHT` to reflect the dimensions reported
	 in the invalid image's header rather than the valid image's header, which might
	 have caused the caller to allocate too small of a buffer to hold the
	 decompressed valid image.
	11. `tj3DecompressHeader()` now always removes the ICC profile (if any) that
	 was previously extracted into the TurboJPEG instance.  This addresses an
	 oversight in 3.2 beta1[10] whereby, if the same TurboJPEG instance was used to
	 decompress or transform multiple JPEG images, then `tj3GetICCProfile()` and
	 `tj3TransformBufSize()` behaved as if JPEG images with no ICC profile contained
	 the last ICC profile extracted.
	12. `tj3TransformBufSize()` has been improved in the following ways:
	     - The function now accounts for the size of all extra markers (including
	 comments, JFIF thumbnails, and Exif data) that will be copied from the source
	 image to the destination image, given the current value of
	 `TJPARAM_SAVEMARKERS` and the specified transform options.
	     - The function now returns accurate results regardless of the value of
	 `TJPARAM_SAVEMARKERS` at the time `tj3DecompressHeader()` was called.  This
	 reflects the fact that only the current value of `TJPARAM_SAVEMARKERS` and the
	 specified transform options affect the marker copying behavior in
	 `tj3Transform()`.
	13. Fixed issues in jpegtran that prevented a grayscale image from being
	 dropped into a subsampled input image or vice versa.
	14. Hardened the TurboJPEG API against hypothetical applications that may
	 erroneously attempt to use the same insufficiently large pre-allocated
	 destination buffer for multiple simultaneous transform operations in
	 `tj3Transform()`.  This caused a use-after-free issue, because the
	 caller-specified destination buffer was no longer valid after the first
	 transform operation reallocated it.
	15. Fixed multiple issues in the standalone (non-merged) RGB565 color
	 converters that occurred when attempting to decompress more than one scanline
	 at a time from a vertically subsampled JPEG image.  These issues caused a
	 buffer overrun and subsequent segfault if the output image rows were not 4-byte
	 aligned, the image width was 1, and both the vertical sampling factor and the
	 number of scanlines decompressed at a time were greater than 2.  In other
	 cases, the issues caused incorrect dithered output.  The issues could not be
	 reproduced using djpeg (which decompresses one scanline at a time) and were not
	 known to exist in any other applications.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 lfs/libjpeg | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lfs/libjpeg b/lfs/libjpeg
index 4dcfaf4f0..17c22c2f0 100644
--- a/lfs/libjpeg
+++ b/lfs/libjpeg
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 3.2.0
+VER        = 3.2.1
 
 THISAPP    = libjpeg-turbo-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = c50c985f8b870ab6467181f69e10f3ec2705cb349613b9178b293f136063e302087832d87f793b3d24ab721a2f5d76271760bd244d0766ab3b8cbe48ebf50cfa
+$(DL_FILE)_BLAKE2 = eeae531ca1dd7665f72e97eb77d47f00251e965758cc6808434082b13c9ef193a86de9281a2e1c541339d00a8641d324452a8654c39e10c45530f5ea39175b5c
 
 install : $(TARGET)
 
-- 
2.56.0

[PATCH] nano: Update to version 9.3

[Adolf Belka]

- Update from version 9.2 to 9.3
- No change in rootfile
- Changelog
9.3
	• On the mini bar, an overlong filename gets properly clipped.
	• The keypad operator keys produce their inscribed characters.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 lfs/nano | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lfs/nano b/lfs/nano
index b308f1258..ea1e39091 100644
--- a/lfs/nano
+++ b/lfs/nano
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 9.2
+VER        = 9.3
 
 THISAPP    = nano-$(VER)
 DL_FILE    = $(THISAPP).tar.xz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = b8f5aedbb296654817eac82723a6ae6323b2710d225152ee6356fefe5e692958236a00ab4c7fd5abff71b84c3c023afc06854e4e216b80879c48ce94486c4b89
+$(DL_FILE)_BLAKE2 = fc1ad405e70086cd37e88e09d78891023b514c2b9a0ab724d7bcef2063f1503d4beb38f1cf5a50df52b8abec9acf8f718c57ab68f01686d6a95a167e96776b34
 
 install : $(TARGET)
 
-- 
2.56.0