* [git.ipfire.org] IPFire 2.x development tree branch, next, updated. 6bae1ddacbfad8ed231b8a71b7a7a8acc0519322
@ 2026-07-05 16:08 Michael Tremer
0 siblings, 0 replies; only message in thread
From: Michael Tremer @ 2026-07-05 16:08 UTC (permalink / raw)
To: ipfire-scm
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 113841 bytes --]
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".
The branch, next has been updated
via 6bae1ddacbfad8ed231b8a71b7a7a8acc0519322 (commit)
via 3dee4acd5ac337f9a45017803dc5bdec325d51f3 (commit)
via b131e5cc2da3e64d2b17b7f3e4fe62e55c1f67ce (commit)
via 9ccfc7869616416d1263391142d57fd88f668ab4 (commit)
via 540cc720f40f49285b1a2a84e6ab5b0e811783a6 (commit)
via ccbae939a5e3e5bcdd5895534cb54825cb4aa12a (commit)
via f73e3488a4a2a151224bffc43b6f330e68b20cd6 (commit)
via 29ddf8bb29ca9658a9b6c892096de074ad182e93 (commit)
via 6bca5223eb75bd13fff2486dd6366737cb8c970b (commit)
via 984afad81787d8852afbbc53df9321c722bea17e (commit)
via 888122e558614741b6f5b7627f5fc57cd2fb8ee4 (commit)
via 342421ec8846efcba41a7d7ddd52761e6aa5729e (commit)
via 00ad18c463d756ca3e0b98af210c10c78af137e8 (commit)
via daa1d9f1a7abd983f50fdd80b8635d15d0ad3e29 (commit)
via cabc35cbfd17c2490977cc2ac3ee2fbaf917509d (commit)
via 6875a3b195a4e5c72e12f2511733e164ec2f4d94 (commit)
via 89c081077da542d01efec9918a71304566f99093 (commit)
via d1fdcc2ae4c3fc4172abec8d4ef54e3018c2de48 (commit)
via 295d87133ccf2f365252edbdeead6708e1b6ea87 (commit)
via 789e59cbed18d04edc589d6836c466e9cf9d8d5b (commit)
via 2e93fbc2cdc442f2b9267c19d66f926df20f9e51 (commit)
via 93de025ef4b644e52a14d0a593bd55c3fa6be0e6 (commit)
via bd06f92cb5284803f42ea0b61e9dc3801e4463ae (commit)
via eefd1dfcf7402f8f3a720946717e76fa912da377 (commit)
via c06b4f44816f1e9e93fe465cfed00d4ef986e94f (commit)
from 704a0d7874ec5b2370536948d89ed5c08ecfd44b (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit 6bae1ddacbfad8ed231b8a71b7a7a8acc0519322
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Sat Jul 4 17:38:49 2026 +0200
core204: Ship tar
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 3dee4acd5ac337f9a45017803dc5bdec325d51f3
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Sat Jul 4 17:38:48 2026 +0200
tar: Avoid acl_ prefixes for functions
- The latest updates for acl and attr created some functions that ended up duplicating
ones that tar had created. This patch has been implemented to make these functions
start with tar_ so that they are specific to the tar project.
- No change to the rootfile
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit b131e5cc2da3e64d2b17b7f3e4fe62e55c1f67ce
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Sat Jul 4 17:38:47 2026 +0200
core203: Ship attr
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 9ccfc7869616416d1263391142d57fd88f668ab4
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Sat Jul 4 17:38:46 2026 +0200
attr: Update to version 2.6.0
- Update from version 2.5.2 to 2.6.0
- Update rootfile
- 1 CVE fix
- Changelog
2.6.0
- Security fixes for CVE-2026-54371:
- Fix symlink traversal privilege escalation vulnerability in getfattr and
setfattr
- Harden getfattr to properly handle symlinks with -h/--no-dereference option
- Harden setfattr --restore with new -P/--physical option for safe restoring
- Add warnings for potentially unsafe restore operations (can be disabled
with the --disable-unsafe-restore-warnings configure option)
- New extended attribute system call support:
- Add wrappers for new xattrat() system calls (getxattrat, setxattrat,
listxattrat, removexattrat) introduced in kernel 6.13
- Add backwards compatibility layer for older systems without xattrat()
support
- Add openat2() syscall wrapper support for enhanced security (kernel 5.6+)
- Code improvements and fixes:
- Add new walk_tree helper, remove old implementation
- Fix multiple memory management issues in attr_copy_* functions
- Fix race conditions in listxattr and lgetxattr operations
- Fix buffer overflow and use-after-free bugs in setfattr --restore
- Remove dead code and improve compiler warning handling
- Add visibility attribute support for better library symbol management
- Build system and compatibility:
- Improve test suite for SELinux environments
- Add License variable to pkg-config file
- Fix various compiler warnings with -Wall, -Wextra, -Wmissing-prototypes
- Add missing header includes and mark local functions static
- Translation updates:
- Update the German translation
- Configuration updates:
- Remove obsolete system.nfs4acl entry from xattr.conf
- Add configure option --disable-unsafe-restore-warnings
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 540cc720f40f49285b1a2a84e6ab5b0e811783a6
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Sat Jul 4 17:38:45 2026 +0200
core204: Ship acl
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit ccbae939a5e3e5bcdd5895534cb54825cb4aa12a
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Sat Jul 4 17:38:44 2026 +0200
acl: Update to version 2.4.0
- Update from version 2.3.2 to 2.4.0
- Update of rootfile
- 2 CVE fixes
- Changelog
2.4.0
* Major security and robustness improvements:
- Fix multiple security vulnerabilities: CVE-2026-54369 and CVE-2026-54370
- Harden setfacl, getfacl, and chacl against malicious input
- Prevent NULL pointer dereferences and memory corruption
- Fix setfacl --restore for pathnames beginning with whitespace
- Prevent setfacl --restore --test from changing file permissions
* New library functions:
- Add acl_get_file_at(), acl_set_file_at(), acl_delete_def_file_at() for
safer file operations using file descriptors and to control symlink
following
- acl_delete_def_file_at() allows removing default ACLs via file descriptor
* API improvements and bug fixes:
- Remove libacl dependency on libattr
- Reject invalid numeric UIDs and GIDs in libacl
- Fix memory wasting loop when user does not exist
- Retry harder in acl_get_file/acl_get_fd operations
- Improve errno handling in acl permission functions
- Fix compiler warnings and sequence point issues
* Build system and code organization:
- Rename internal symbols with __acl_ prefix to avoid conflicts
- Internalize walk_tree API and replace with hardened version
- Mark local variables and functions static where appropriate
- Remove unnecessary dependencies and dead code
* Test suite improvements:
- Fix test compatibility issues with getpwnam/getgrnam functions
- Add comprehensive restore.run test for --restore functionality
- Fix shell quoting errors in test scripts
- Improve test lookup library accessibility
* Documentation updates:
- Clarify symlink following behavior in manual pages
- Document new _at function variants
- Clarify that on Linux, acl_perm_t is a bitset
* Translation updates:
- German translation update
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit f73e3488a4a2a151224bffc43b6f330e68b20cd6
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Fri Jul 3 21:41:22 2026 +0200
core204: Ship vim
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 29ddf8bb29ca9658a9b6c892096de074ad182e93
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Fri Jul 3 21:41:33 2026 +0200
vim: Update to version 9.2.0769
- Update from version 9.2.0526 to 9.2.0769
- Update of rootfile
- Changelog is not available. Generally each patch version number update is related to
a commit entry in the git repository. The details for all the commit changes can be
found at https://github.com/vim/vim/commits/master/
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 6bca5223eb75bd13fff2486dd6366737cb8c970b
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Fri Jul 3 21:41:21 2026 +0200
core204: Ship systemd
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 984afad81787d8852afbbc53df9321c722bea17e
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Fri Jul 3 21:41:32 2026 +0200
systemd: Update to version 261.1
- Update from version 260.1 to 261.1
- Update of rootfile
- Changelog
261.1
This only lists the commits and not easy to identify what might be related to
udev. This is the link to the commits.
https://github.com/systemd/systemd/compare/v261...v261.1
261
Changes in systemd-udevd, hwdb and udev rules:
* The DMI ID device (/sys/class/dmi/id) is now tagged so that
early-boot consumers can reliably order against it.
* udev's "blkid" builtin will now set a new udev property
ID_PART_GPT_AUTO_ROOT_DISK_NEEDS_LOOP=1 on boot block devices where a
GPT partition table is detected for a sector size different from the
native sector size of the device. (This typically happens if a Hybrid
ISO9660/GPT disk image is booted as CDROM, where the native sector
size is 2048 but the GPT header uses a 512-byte sector size). If this
happens then a systemd-loop@.service instance is automatically pulled
in via a udev rule that generates a loopback block device from the
discovered block device, exposing the device with the corrected
sector size. Or in other words: booting a fully valid GPT disk image
on a block device with a non-matching sector size will now just work,
and automatically result in a matching loopback device popping
up. The new property is also set if the boot block device carries a
GPT header (i.e. is partitioned) but the block device has partition
table processing turned off.
* Persistent network interface naming has been extended to auxiliary
sub-function (SF) network devices (such as mlx5_core SFs), using an
"S<sfnum>" suffix appended to the parent PCI function's name (e.g.
"enp193s0f0S88").
260.3
This only lists the commits and not easy to identify what might be related to
udev. This is the link to the commits.
https://github.com/systemd/systemd/compare/v260.2...v260.3
260.2
This only lists the commits and not easy to identify what might be related to
udev. This is the link to the commits.
https://github.com/systemd/systemd/compare/v260.1...v260.2
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 888122e558614741b6f5b7627f5fc57cd2fb8ee4
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Fri Jul 3 21:41:31 2026 +0200
sqlite: Update to version 3530300
- Update from version 3530200 to 3530300
- Update of rootfile
- Changelog
3530300
Fixes for problems in 3.53.0 (and 3.53.1 and 3.53.2) mostly coming from AIs.
See the check-in timeline for details.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 342421ec8846efcba41a7d7ddd52761e6aa5729e
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Fri Jul 3 21:41:20 2026 +0200
core204: Ship pango
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 00ad18c463d756ca3e0b98af210c10c78af137e8
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Fri Jul 3 21:41:30 2026 +0200
pango: Update to version 1.58.0
- Update from version 1.57.1 to 1.58.0
- Update of rootfile
- Changelog
1.58.0
* PangoFontDescription has a new width attribute, which
is like stretch, but allows intermediate values
* PangoRenderer has gained the ability to render only certain
components of a layout (such overlines, underlines, text,...)
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit daa1d9f1a7abd983f50fdd80b8635d15d0ad3e29
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Fri Jul 3 21:41:19 2026 +0200
core204: Ship libjpeg
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit cabc35cbfd17c2490977cc2ac3ee2fbaf917509d
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Fri Jul 3 21:41:29 2026 +0200
libjpeg: Update to version 3.2.0
- Update from version 3.1.4.1 to 3.2.0
- Update of rootfile
- Changelog
3.2.0
Significant changes relative to 3.2 beta1:
1. Fixed a regression introduced by 3.2 beta1[9] that broke Arm64EC Windows
builds.
2. Hardened the PNG writer (which is used by djpeg and `tj3SaveImage*()`)
against applications that may erroneously attempt to write sample values that
are out of range for the specified output data precision. This could have
caused a buffer overrun in the PNG writer's rescale array if the output data
precision was not 8 or 16 bits. The buffer overrun did not likely pose a
security risk, since `tj3SaveImage*()` is not exposed to arbitrary external
input data and since a caller that abused the API in the aforementioned manner
could never work properly.
3. Hardened the libjpeg API against hypothetical applications that may
erroneously call `jpeg_crop_scanline()` with buffered-image mode and raw data
output enabled. `jpeg_crop_scanline()` does not work with raw data output, but
due to an oversight, it did not throw an error if both buffered-image mode and
raw data output were enabled. If a hypothetical application aborted a normal
decompression operation without reading any scanlines, started a new
decompression operation using the same libjpeg instance with buffered-image
mode and raw data output enabled, then called `jpeg_crop_scanline()` with
arguments that would have caused any of the component planes to be cropped to a
width of 1 sample, `jpeg_crop_scanline()` would have used freed memory.
However, this did not likely pose a security risk, since an application that
abused the API in the aforementioned manner could never work properly.
4. Fixed a buffer overrun and subsequent segfault in jpegtran that occurred
when attempting to use the `-crop` and `-trim` options to expand the width of
an image narrower than one iMCU, discard partial iMCUs, and fill each block in
the expanded region with the DC coefficient of the nearest block in the input
image ("flatten.") Similarly, fixed an infinite loop that occurred when
attempting to use the `-crop` and `-trim` options to expand the width of an
image narrower than one iMCU, discard partial iMCUs, and fill the expanded
region with repeated reflections of the input image ("reflect.") When the only
iMCU column in the input image is partial and partial iMCUs are trimmed, the
flatten and reflect extensions cannot work properly, so jpegtran now throws an
error if that is the case. These issues were confined to the jpegtran
application and thus did not pose a security risk.
3.1.90 (3.2 beta1)
Significant changes relative to 3.1.4.1:
1. The legacy GNU Assembler (GAS) implementation of the Arm Neon SIMD
extensions has been removed. Arm builds of libjpeg-turbo must now use GCC 12
or later or Clang in order to achieve full performance.
2. The SIMD dispatchers have been overhauled so that the list of supported SIMD
instruction sets is initialized on a per-instance basis rather than a
per-thread basis, thus eliminating the need for thread-local storage in the
libjpeg API library. The overhaul also streamlines and modernizes the
dispatcher architecture, eliminates redundant and unnecessary code, and
generally simplifies the process of adding new SIMD extensions. A new test
program (simdcoverage) can be used to validate the correctness of a particular
dispatcher.
3. If the `WITH_PROFILE` CMake variable is enabled, libjpeg-turbo now measures
the cumulative average throughput of each lossy JPEG compression and
decompression algorithm and reports it to the command line when
`jpeg_destroy_compress()`, `jpeg_destroy_decompress()`, or `tj3Destroy()` is
called.
4. jpegtran now honors the `-trim` and `-perfect` options when expanding the
image size using the `-crop` option. If `-trim` is specified, then partial
iMCUs from the source image are discarded in the expanded image (equivalent to
the previous behavior.) If `-trim` is not specified, then partial iMCUs are
left in place. If `-perfect` is specified, then expanding the image size using
the `-crop` option will fail if there are any partial iMCUs in the source
image. The new default behavior is useful, in combination with the `-drop`
option, for reversibly combining multiple JPEG source images into a single
composite JPEG image.
5. The MIPS DSPr2 SIMD extensions have been removed. Justifications:
- MIPS Technologies deprecated the MIPS architecture in favor of RISC-V in
2021.
- The DSPr2 instruction set was already obsolete at that point, having
been superseded by the MSA instruction set (which is now also deprecated.)
- The overall speedup from the DSPr2 SIMD extensions was never compelling,
in part because some of the modules were implemented using scalar (non-SIMD)
instructions and were thus no faster than the equivalent C modules.
- Some of the DSPr2 SIMD modules had long-standing bugs, and it was
necessary to disable those modules in order to prevent accuracy issues with
libjpeg-turbo on MIPS CPUs.
- The DSPr2 SIMD extensions only worked with 32-bit MIPS applications.
- The libjpeg-turbo Project has never had access to a MIPS test platform,
which limited our ability to maintain the DSPr2 SIMD extensions.
Even before the MIPS architecture was deprecated, the aforementioned
limitations had already reduced the number of platforms and applications that
could benefit from the DSPr2 SIMD extensions to near zero. The DSPr2 SIMD
extensions will continue to be maintained in the 3.1.x branch on a break/fix
basis.
6. Added RISC-V Vector (RVV) SIMD implementations of the colorspace conversion,
chroma downsampling and upsampling, integer quantization and sample conversion,
and integer DCT/IDCT algorithms. When using the accurate integer DCT/IDCT
algorithms, RGB-to-baseline JPEG compression is approximately 149-246% (avg.
201%) faster relative to libjpeg-turbo 3.1.x, and baseline-to-RGB JPEG
decompression is approximately 48-180% (avg. 115%) faster. (Tested on a 1.6
GHz Ky X1 CPU. Actual mileage may vary.)
7. The TurboJPEG Java API has been moved to a
[dedicated repository](https://github.com/libjpeg-turbo/turbojpeg-java) where
it can evolve independently of the TurboJPEG C API based on demand.
Justifications:
- The TurboJPEG Java API was designed around the needs of Java Web Start,
an obsolete "zero-install" method of Java application deployment. The idea was
that JWS applications could be deployed along with JAR files containing the
TurboJPEG Java API and TurboJPEG API library, which contained Java Native
Interface (JNI) bindings to support the former. It made sense for our project
to package those resources so downstream developers could easily sign and
deploy them via JWS. These days, however, Java applications are more
frequently deployed as standalone applications.
- The TurboJPEG Java API was designed at a time when libjpeg-turbo was not
ubiquitous and JNA was nascent. These days, libjpeg-turbo is used by most
operating systems, so there is less of a need for us to package an end-to-end
solution for high-speed JPEG support in Java.
- The Java-friendly design of the TurboJPEG Java API (specifically, the
requirement that it work directly with Java arrays rather than NIO buffers)
necessitated allocating all buffers on the Java heap in order to avoid buffer
copies. That necessitated using fixed-size JPEG buffers (the equivalent of
`TJPARAM_NOREALLOC`), which meant that all JPEG buffers had to be big enough to
account for the size of the ICC profile and the possibility of zero
compression. Some of the proposed new TurboJPEG API features would have been
impossible to implement in the TurboJPEG Java API without completely
redesigning it.
- The Java-friendly design of the TurboJPEG Java API made it
more difficult to maintain, document, and extend than the C API, which reduced
our ability to add needed features in a timely manner.
Example code (TurboJPEG/JNA) demonstrating how to use the TurboJPEG C API
through Java Native Access (JNA) has been added to the source tree and can be
built, tested, and installed by setting the `WITH_JNA` CMake variable.
TurboJPEG/JNA generally performs as well as the TurboJPEG C API, whereas
compressing JPEG images with the TurboJPEG Java API was slower on some
platforms.
8. To facilitate shadow recovery in underexposed images, the libjpeg and
TurboJPEG APIs and associated programs now allow an 8-bit-per-sample lossy JPEG
image to be decompressed to a 12-bit-per-sample output image. This is enabled
in the libjpeg API by setting `cinfo->data_precision = 12` after calling
`jpeg_read_header()`, and in the TurboJPEG API by calling `tj3Decompress12()`
after calling `tj3DecompressHeader()`.
9. cjpeg, djpeg, `tj3LoadImage*()`, and `tj3SaveImage*()` now support
8-bit-per-channel and 16-bit-per-channel PNG images.
- By default, cjpeg transfers the embedded ICC profile from a PNG input
image to the JPEG image, and djpeg transfers the embedded ICC profile from the
JPEG image to a PNG output image. A new option (`-noicc`) can be used to
disable that behavior.
- If called with a TurboJPEG compression instance, `tj3LoadImage*()`
extracts the embedded ICC profile from a PNG image and associates it with the
TurboJPEG instance if `TJPARAM_SAVEMARKERS` is set to 2 or 4.
- If called with a TurboJPEG decompression instance, `tj3SaveImage*()`
transfers the ICC profile that was previously extracted from the JPEG image to
a PNG image if `TJPARAM_SAVEMARKERS` is set to 2 or 4.
- The PNG writer upscales images with 2-7 and 9-15 bits of data
precision to, respectively, 8-bit-per-channel and 16-bit-per-channel PNG
images. The upscaling algorithm is reversible, so a lossless JPEG image with a
non-standard data precision can be losslessly converted to a PNG image and back
to a lossless JPEG image with the same data precision.
10. The TurboJPEG API has been improved in the following ways:
- `tj3GetICCProfile()` can now be called multiple times to retrieve the
ICC profile that was previously extracted from a JPEG image.
- `tj3GetICCProfile()` can now be used to retrieve the ICC profile
associated with a TurboJPEG compression instance (including an ICC profile
extracted from a PNG image by `tj3LoadImage*()`.)
- The JPEG colorspace can now be reset to the default, using a new
`TJPARAM_COLORSPACE` value (`TJCS_DEFAULT`.)
- 4:1:0 and 2:4 subsampling are now supported.
11. Added a new cjpeg, djpeg, and jpegtran option (`-nooverwrite`) that causes
the programs to fail if the specified output file exists.
12. jpegtran now includes a `-roll` option that performs a lossless roll
transform (shift with wraparound), which is similar in concept to the `-roll`
option in ImageMagick and the Offset filter/tool in Photoshop and GIMP.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 6875a3b195a4e5c72e12f2511733e164ec2f4d94
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Fri Jul 3 21:41:18 2026 +0200
core204: Ship libarchive
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 89c081077da542d01efec9918a71304566f99093
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Fri Jul 3 21:41:28 2026 +0200
libarchive: Update to version 3.8.8
- Update from version 3.8.7 to 3.8.8
- Update of rootfile
- Changelog
3.8.8
New features:
add support for reading encrypted zipx formats (bzip2, lzma, ppmd, xz, zstd) (#2685)
Fix overview:
build
build: Fix build with glibc 2.43 (#2969)
libarchive core
core: Fix NULL pointer increment in archive_acl_from_text_nl (#2905)
core: fix archive_entry_set_mode & archive_entry_set_perm (#2942)
core: Fix a double-free in the link resolver (#2957)
core: On Darwin, get digests from libsystem (#2973)
core: Fix buffer overrun and wrong output for NULL-name ACL entries (#2988)
core: archive_read: FATAL should be sticky for all API calls (#2998, #3009)
core: Date parsing: reject dates with numbers of more than 4 digits (#3010)
core: acl: parser out-of-bounds read (#3011)
core: pathmatch: heap buffer over-read (#3012)
core: pathmatch: Treat anchors not special without flags (#2928)
core: archive_match: Prevent call stack overflow (#2927)
core: sparse: UAF in sparse_reset (#3019)
core: Fix a number of unchecked memory allocations (#3040)
core: strmode: Remove strcpy usage (#3037)
core: cmdline: Use free+strdup instead of realloc+strcpy (#3036)
core: Fix libattr version returned in archive_version_details, as well as
a leak (#3064)
core: Fix integer overflow in __archive_read_filter_ahead (#3083)
core: read: Fix memory corruption on filtered multi-volume archives (68b6924)
core: Fix OOB in archive_read_open_filenames_w on some systems (#3114)
core: read_disk: Check if off_t can overflow size_t (#3146)
multiple: Fix mem leaks found with ASAN-enabled test suites (#2971)
windows: remove support for WinCrypt (#2739)
windows: util: Fix GetTempPathW TOCTOU race condition (#3044)
filters support
bzip2: Support large in-memory archives (#3050)
filter: compress: Fix SIGSEGV when appended before open (#2526)
filter: Remove unneeded strcpy calls (#3033)
filter: Fix mismatched filter function dispatch table entry in
archive_write_add_filter.c (#3054)
gzip: Support more large in-memory archives (#3085)
gzip: Fix OOB in writer with huge filename (#3115)
lz4: Check XXH32_init result (#3100)
lz4: Improve truncated input stream detection (#3093)
lz4: Fix double-free on reallocation failure (#3132)
uu: Extend range checks to avoid 32 bit OOB (#3103)
zstd: Fix 32 bit platform endless loop and OOB access during bidding (#3073)
zstd: Fix 32 bit platform endless loop and OOB access during bidding (#3073)
7-ZIP reader and writer
7-zip: Sanity-check the number of files (#2980)
7-zip: Harden SFX parser (#2985)
7-zip: Clean up the failure path in setup_decode_folder (#3002)
7-zip: Fix 32 bit heap overflow (#3006)
7-zip: Verify that Codec ID fits into 63 bit (#2929)
7-zip: writer: free file->utf16name on symlink UTF-8 conversion failure
(#3062)
7-zip: Support streamable reading again (#3074)
7-zip: Set error message in case of error (#3067)
7-zip: Extend support for filtered input (#3099)
7-zip: fix a number of issues in zstd detection (#3102)
7-zip: Fix range check in get_pe_sfx_offset (#3119)
7-zip: sanity-check FilesInfo NumFiles before allocating entries (#2923)
CAB reader
cab: reader: Fix use of uninitialized values from Huffman table (#2979)
cab: Harden the handling of invalid headers (#3000)
cab: Fix multi volume parser (#3153)
cab: Properly limit maximum name length (#3145)
cab: Improve truncation detection (#3144)
CPIO reader and writer
cpio: reader: Validate pathname in record_hardlink (#2984)
cpio: reject oversized pathnames before read-ahead (#3043)
cpio: Fix UAF in error path (#3055)
cpio: Improve afio header detection (#3095)
cpio: Fix writer OOB read with very long filenames (#3158)
cpio: fix OOB read from int pathlength truncation in newc/binary writers
(#3168)
iso9660 reader and writer
iso9660: Fix .. (dot dot) path normalization (#2968)
iso9660: Fix joliet pathname overflow (#2983)
iso9660: Fix NULL deref and Joliet ID overflow (#3017)
iso9660: Fix OOB during Joliet ID generation (#2974)
iso9660: Fix infinite loop in Joliet ID generation (#2978)
iso9660: Fix memory leaks on error paths (#3029)
iso9660: bound duplicate identifier extension placement (#3045)
iso9660: Fix null dereference in set_directory_record_rr (#3117)
iso9660: fix infinite loop on self-referencing CE entry (#3021)
mtree reader and writer
mtree: Escape standard pathname matching characters (#3007)
mtree: Do not append '/' when basename is '.' (#3008)
mtree: NULL pointer deref during archive close (#3018)
mtree: Fix hex parser (#2982)
mtree: Fix time value parser truncation (#2930)
mtree: Port iso9660 fix for .. (dot dot) path normalization (#3032)
mtree: Fix null dereference for some corner cases (#3057)
RAR reader
rar: avoid reading NEWSUB extended data during header parsing (#3015)
rar: Simplify FILE_ATTRIBUTE_DIRECTORY check (#3087)
rar: skip NEWSUB payloads without size cap (#3047)
rar: reset low-distance state for new LZ tables (#3048)
rar: Add missing bound check for staticdata (#3105)
RARv5 reader
rar5: FAIL if the decode table is > 2^16 (#3004)
rar5: Avoid dangling pointers in init_unpack (#3081)
rar5: skip unconsumed block bytes before ARCHIVE_RETRY (#3091)
rar5: fix signed integer underflow in bytes_remaining (#3121)
TAR reader and writer
tar: Harden timestamp parsing (#2991)
tar: Improve string safety in list_item_verbose (#3038)
tar: Fix OOB with empty wide character directory names (#3052)
WARC reader and writer
warc writer: free hdr on _popul_ehdr overflow in _warc_header (#3061)
XAR reader and writer
xar: Fix two UB (#3013)
xar: Avoid integer overflows in number parsers (#3030)
xar: Free XAR xattr fstype metadata during cleanup (#3028)
xar: Port iso9660 fix for .. (dot dot) path normalization (#3032)
xar: fix fflags_text leak in file_free (#3060)
xar: Fix writer OOB accesses with fflags (#3041)
ZIP reader and writer
zip: Limit the LZMA initialization to 64MiB memory (#2981)
zip: Don't try to write overlong pathnames (#2993)
zip: Reject empty pathnames in ZIP writer (#2996)
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit d1fdcc2ae4c3fc4172abec8d4ef54e3018c2de48
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Fri Jul 3 21:41:17 2026 +0200
core204: Ship json-c
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 295d87133ccf2f365252edbdeead6708e1b6ea87
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Fri Jul 3 21:41:27 2026 +0200
json-c: Update to version 0.19
- Update from version 0.18 to 0.19
- Update of rootfile
- Removal of cmake patch as now included in the tarball.
- Changelog
0.19
New features
* Add support for Commodore Amiga and MorphOS
* Allow builds with CMake 4 - sync minimum version across all CMakeLists.txt
files
* Update openssl command to work for newer versions of openssl.
* Add support for building json-c with meson
* Support MSVC in packages that use GNU Autoconf.
* Add VERSIONINFO to libjson-c.dll
* Make json_tokener_free(NULL) a no-op, to simplify cleanup paths.
* Explicitly handle NaN values when converting to int
* Set errno=RANGE in json_object_get_int/int64/uint64() when the source value
can't be represented in the target type.
* Make json_parse a bit more useful by adding -u (validate UTF8) and -P
(specify arbitrary tokener parse flags), and read from stdin if no filename
is provided.
* Fix the apps/json_parse "-s" (strict) option so it actually does something,
and default to non-strict.
Significant changes and bug fixes
* Issue #867 - also disallow control characters in keys in JSON_TOKENER_STRICT
mode
* Issue #875: cast to unsigned char so bytes above 0x7f aren't interpreted as
negative, which was causing the strict-mode control characters check to
incorrectly trigger.
* Issue #881: don't allow json_tokener_new_ex() with a depth < 1
* Fix linkhash breaking -std=c89
* Fixing Cmake build when using clang-cl, avoids errors about redefining
existing symbols
* Fix AIX build failure - Add CMake detection for getopt.h
* Fix bug involving supplemental code points that look like high surrogates
* Fix runtime issue with test_util_file.c in Windows (add O_BINARY)
* Fix macro WIN32_LEAN_AND_MEAN redefined
* Issue #914: Fix Memory usage regression due to newlocale() on macOS
* Issue #916: Fix OOM via large array index in json_pointer_set
* Issue #923: Avoid stack recursion in json_object_put()
* Issue #927: CVE-2026-9146 - update json_object_iterator documentation
* Issue #929: CVE-2026-11322 - fix information disclosure bug in
apps/json_parse (not installed by default)
* Issue #930: fix locale-dependent strtod in json_object_get_double
* Issue #931: deep copy values in json_patch copy op to avoid aliasing and cycles
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 789e59cbed18d04edc589d6836c466e9cf9d8d5b
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Fri Jul 3 21:41:16 2026 +0200
core204: Ship glib
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 2e93fbc2cdc442f2b9267c19d66f926df20f9e51
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Fri Jul 3 21:41:26 2026 +0200
glib: Update to version 2.88.2
- Update from version 2.88.1 to 2.88.2
- Update of rootfile
- Changelog
2.88.2
* Bugs fixed:
- !5178 Backport !5176 “gnulib: Fix unused flags variable warning” to
glib-2-88
- !5179 Update German translation
- !5181 Update Thai translation
- !5203 Update Basque translation
- !5208 Update Italian translation
- !5219 Backport !5209 “CI: set msys2-clang64 as default job for merges” to
glib-2-88
- !5220 Update Polish translation
* Translation updates:
- Basque (Asier Saratsua Garmendia)
- German (Jürgen Benvenuti)
- Italian (Davide Ferracin)
- Polish (Victoria Niedzielska)
- Thai (Aefgh Threenine)
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 93de025ef4b644e52a14d0a593bd55c3fa6be0e6
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Fri Jul 3 21:41:25 2026 +0200
git: Update to version 2.55.0
- Update from version 2.54.0 to 2.55.0
- Update of rootfile
- Changelog
2.55.0
UI, Workflows & Features
Hook scripts defined via the configuration system can now be
configured to run in parallel.
The userdiff driver for the Scheme language has been extended to
cover other Lisp dialects.
Terminal control sequences coming over the sideband while talking
to a remote repository are mostly disabled by default, except for
ANSI color escape sequences.
"ort" merge backend improvements.
"git checkout -m another-branch" was invented to deal with local
changes to paths that are different between the current and the new
branch, but it gave only one chance to resolve conflicts. The command
was taught to create a stash to save the local changes.
A new builtin "git format-rev" is introduced for pretty formatting
one revision expression per line or commit object names found in
running text.
"git history" learned "fixup" command.
The internal URL parsing logic has been made accessible via a new
subcommand "git url-parse".
Misspelt proxy URL (e.g., httt://…) did not trigger any warning
or failure, which has been corrected. We had a regression in this
update that broke https:// proxies, but that has been caught and
corrected.
Document the fact that .git/info/exclude is shared across worktrees
linked to the same repository.
The command line parser for "git diff" learned a few options take
only non-negative integers.
The graph output from commands like "git log --graph" can now be
limited to a specified number of lanes, preventing overly wide output
in repositories with many branches.
The fsmonitor daemon has been implemented for Linux.
"git cat-file --batch" learns an in-line command "mailmap"
that lets the user toggle use of mailmap.
The "git pack-objects --path-walk" traversal has been integrated
with several object filters, including blobless and sparse filters.
"git push" learned to take a "remote group" name to push to, which
causes pushes to multiple places, just like "git fetch" would do.
The git-jump command (in contrib/) has been taught to automatically
pick a mode (merge, diff, or ws) when invoked without arguments.
The documentation for push.default = simple has been clarified to
better explain its behavior, making it clear that it pushes the
current branch to a same-named branch on the remote, and detailing
the upstream requirements for centralized workflows.
The documentation for "--word-diff" has been extended with a bit of
implementation detail of where these different words come from.
"git config foo.bar=baz" is not likely to be a request to read the
value of such a variable with = in its name; rather it is plausible
that the user meant "git config set foo.bar baz". Give advice when
giving an error message.
"git rev-list" (and "git log" family of commands) learned a new
"--max-count-oldest"
that picks oldest N commits in the range instead of the usual newest.
Various AsciiDoc markup fixes in git config documentation and
related files to ensure lists and formatting are rendered correctly.
Performance, Internal Implementation, Development Support etc.
Promisor remote handling has been refactored and fixed in
preparation for auto-configuration of advertised remotes.
Rust support is enabled by default (but still allows opting out) in
some future version of Git.
Preparation of the xdiff/ codebase to work with Rust.
Use a larger buffer size in the code paths to ingest pack stream.
Refactor service routines in the ref subsystem backends.
Shrink wasted memory in Myers diff that does not account for common
prefix and suffix removal.
Enable expensive tests to catch topics that may cause breakages on
integration branches closer to their origin in the contributor PR
builds.
"git merge-base" optimization.
The limit_list() function that is one of the core part of the
revision traversal infrastructure has been optimized by replacing
its use of linear list with priority queue.
In a lazy clone, "git cherry" and "git grep" often fetch necessary
blob objects one by one from promisor remotes. It has been corrected
to collect necessary object names and fetch them in bulk to gain
reasonable performance.
The logic to determine that branches in an octopus merge are
independent has been optimized.
The consistency checks for the files reference backend have been updated
to skip lock files earlier, avoiding unnecessary parsing of
intermediate files.
The negotiation tip options in "git fetch" have been reworked to
allow requiring certain refs to be sent as "have" lines, and to
restrict negotiation to a specific set of refs.
The repacking code has been refactored and compaction of MIDX layers
have been implemented, and incremental strategy that does not require
all-into-one repacking has been introduced.
ODB transaction interface is being reworked to explicitly handle
object writes.
Add a new odb "in-memory" source that is meant to only hold
tentative objects (like the virtual blob object that represents the
working tree file used by "git blame").
Many uses of the_repository has been updated to use a more
appropriate struct repository instance in setup.c codepath.
Revision traversal optimization.
Build update.
The logic to lazy-load trees from the commit-graph has been made
more robust by falling back to reading the commit object when
the commit-graph is no longer available.
The "name" argument in git_connect() and related functions has been
converted to a "service" enum to improve type safety and clarify its
purpose.
git restore --staged has been optimized to avoid unnecessarily expanding
the sparse index when operating on paths within the sparse checkout
definition, by handling sparse directory entries at the tree level.
"git stash -p" has been optimized by reusing cached index
entries in its temporary index, avoiding unnecessary lstat()
calls on unchanged files.
The check for non-stale commits in the priority queue used by
paint_down_to_common and ahead_behind has been optimized by
replacing an O(N) scan with an O(1) counter, yielding performance
improvements in repositories with wide histories.
Reachability bitmap generation has been significantly optimized. By
reordering tree traversal, caching object positions, and refining how
pseudo-merge bitmaps are constructed, the performance of "git repack
--write-midx-bitmaps" is improved, especially for large repositories
and when using pseudo-merges.
Adding a decimal integer with strbuf_addf("%u") appears commonly;
they have been optimized by using a custom formatter.
Formatting object name in full hexadecimal form has been optimized
by using a new strbuf_add_oid_hex() helper function.
Encourage original authors to monitor the CI status.
The git log -L implementation has been refactored to use the
standard diff output pipeline, enabling pickaxe and diff-filter to
work as expected. Additionally, metadata-only diff formats like
--raw and --name-only are now supported with -L.
The loose object source has been refactored into a proper struct
odb_source.
Guidelines on how to write a cover letter for a multi-patch series
have been added to SubmittingPatches, which also got a new marker
to separate the section for typofixes.
The setup logic to discover and configure repositories has been
refactored, and the initialization of the object database has been
centralized.
Many core configuration variables have been migrated from global
variables into repo_config_values to tie them to a specific
repository instance, avoiding cross-repository state leakage.
Streaming revision walks have been optimized by using a priority queue
for date-sorting commits, speeding up walks repositories with many
merges.
A recent regression in t7527 that broke TAP output has been fixed,
some other test noise that also broke TAP output has been silenced,
and prove is now configured to fail on invalid TAP output to
prevent future regressions.
A handful of inappropriate uses of the_repository have been
rewritten to use the right repository structure instance in the
unpack-trees.c codepath.
"git index-pack" has been optimized by retaining child bases in the
delta cache instead of immediately freeing them, letting the existing
cache limit policy decide eviction.
git ls-files --modified and git ls-files --deleted have been
optimized to filter with pathspec before calling lstat() when there is
only a single pathspec item, avoiding unnecessary filesystem access
for entries that will not be shown.
The UNUSED macro in compat/posix.h has been updated to use a
newly introduced GIT_CLANG_PREREQ macro for compiler version
checks, and the existing GIT_GNUC_PREREQ macro has been modernized
to use explicit major/minor comparisons rather than bit-shifting.
Wean the Windows builds in GitLab CI procedure away from
(unfortunately unreliable) Chocolatey to install dependencies.
(merge 0e7b51fed2 ps/gitlab-ci-windows later to maint).
Build-fix for 32-bit Windows.
Xcode 15 and later has a linker set to complain when the same library
archive is listed twice on the command line. Squelch the annoyance.
Fixes
Code clean-up to use the right instance of a repository instance in
calls inside refs subsystem.
(merge 57c590feb9 sp/refs-reduce-the-repository later to maint).
The check that implements the logic to see if an in-core cache-tree
is fully ready to write out a tree object was broken, which has
been corrected.
(merge 521731213c dl/cache-tree-fully-valid-fix later to maint).
The test suite harness and many individual test scripts have been
updated to work correctly when set -e is in effect, which helps
detect misspelled test commands.
(merge ffe8005b9d ps/test-set-e-clean later to maint).
Revert a recent change that introduced a regression to help mksh users.
Update various GitHub Actions versions.
Avoid hitting the pathname limit for socks proxy socket during the
test..
To help Windows 10 installations, avoid removing files whose
contents are still mmap()'ed.
The git backfill command now rejects revision-limiting options that
are incompatible with its operation, uses standard documentation for
revision ranges, and includes blobs from boundary commits by default
to improve performance of subsequent operations.
(merge a1ad4a0fca en/backfill-fixes-and-edges later to maint).
"git grep" update.
(merge 9ff4b5ab1b rs/grep-column-only-match-fix later to maint).
Headers from glibc 2.43 when used with clang does not allow
disabling C11 language features, causing build failures..
The http.emptyAuth=auto configuration now correctly attempts
Negotiate authentication before falling back to manual credentials.
This allows seamless Kerberos ticket-based authentication without
requiring users to explicitly set http.emptyAuth=true.
(merge 4919938d28 mc/http-emptyauth-negotiate-fix later to maint).
Ramifications of turning off commit-graph has been documented a bit
more clearly.
(merge 48c855bb8f kh/doc-commit-graph later to maint).
"git rebase --update-refs", when used with an rebase.instructionFormat
with "%d" (describe) in it, tried to update local branch HEAD by
mistake, which has been corrected.
(merge 106b6885c7 ag/rebase-update-refs-limit-to-branches later to maint).
Tweak the way how sideband messages from remote are printed while
we talk with a remote repository to avoid tickling terminal
emulator glitches.
(merge 31e8fcabd8 rs/sideband-clear-line-before-print later to maint).
The configuration variable submodule.fetchJobs was not read correctly,
which has been corrected.
(merge aa45a5902f sj/submodule-update-clone-config-fix later to maint).
Update code paths that assumed "unsigned long" was long enough for
"size_t".
(merge 7a094d68a2 js/objects-larger-than-4gb-on-windows later to maint).
Stop using unmaintained custom allocator in Windows build which was
the last user of the code.
The computation to shorten the filenames shown in diffstat measured
width of individual UTF-8 characters to add up, but forgot to take
into account error cases (e.g., an invalid UTF-8 sequence, or a
control character).
(merge 09d86a3b98 en/diffstat-utf8-truncation-fix later to maint).
Some tests assume that bare repository accesses are by default
allowed; rewrite some of them to avoid the assumption, rewrite
others to explicitly set safe.bareRepository to allow them.
(merge 985b38ca6c js/adjust-tests-to-explicitly-access-bare-repo later to
maint).
Signing commit with custom encoding was passing the data to be
signed at a wrong stage in the pipeline, which has been corrected.
(merge 7735d7eee3 bc/sign-commit-with-custom-encoding later to maint).
Further update to the i18n alias support to avoid regressions.
"git fetch --deepen=<n>" in a full clone truncated the history to <n>
commits deep, which has been corrected to be a no-op instead.
(merge 2431f5e0e5 sp/shallow-deepen-on-non-shallow-repo-fix later to maint).
"git maintenance" that goes background did not use the lockfile to
prevent multiple maintenance processes from running at the same
time, which has been corrected.
(merge 29364f1624 ps/maintenance-daemonize-lockfix later to maint).
Remove ineffective strbuf presizing that would have computed an
allocation that would not have fit in the available memory anyway,
or too small due to integer wraparound to cause immediate automatic
growing.
(merge a9ce8526dc jk/pretty-no-strbuf-presizing later to maint).
The HTTP walker misinterpreted the alternates file that gives an
absolute path when the server URL does not have the final slash
(i.e., "https://example.com" not "https://example.com/").
(merge b92387cd55 jk/dumb-http-alternate-fix later to maint).
"git bisect" now uses the selected terms (e.g., old/new) more
consistently in its output.
(merge cb55991825 jr/bisect-custom-terms-in-output later to maint).
Update GitLab CI jobs that exercise macOS.
(merge 62319b49bb ps/gitlab-ci-macOS-improvements later to maint).
"Friday noon" asked in the morning on Sunday was parsed to be one
day before the specified time, which has been corrected.
(merge b809304101 ta/approxidate-noon-fix later to maint).
The GIT_WORK_TREE variable prepared to invoke the push-to-checkout
hook was leaking into the environment even when there was no hook
used and broke the default push-to-deploy (i.e., let "git checkout"
update the working tree only when the working tree is clean).
(merge 44d04e4426 ar/receive-pack-worktree-env later to maint).
A batch of documentation pages has been updated to use the modern
synopsis style.
(merge 2ef248ae45 ja/doc-synopsis-style-again later to maint).
The "promisor.quiet" configuration variable was not used from
relevant submodules when commands like "grep --recurse-submodules"
triggered a lazy fetch, which has been corrected.
(merge fa1468a1f7 th/promisor-quiet-per-repo later to maint).
Correct use of sockaddr API in "git daemon".
(merge 422a5bf575 st/daemon-sockaddr-fixes later to maint).
A memory leak in fetch_and_setup_pack_index() when verification of
the downloaded pack index fails has been plugged. Also an obsolete
unlink() call on parse failure has been cleaned up.
In t3070-wildmatch, "via ls-files" test variants with patterns
containing backslash escapes are now skipped on Windows, avoiding 36
test failures caused by pathspec separator conversion.
(merge 8c84e6802c kk/wildmatch-windows-ls-files-prereq later to maint).
A linker warning on macOS when building with Xcode 16.3 or newer has
been avoided by passing -fno-common to the compiler when a
sufficiently new linker is detected.
(merge 5cd4d0d850 hn/macos-linker-warning later to maint).
Documentation and tests have been added to clarify that Git’s internal
raw timestamp format requires a @ prefix for values less than
100,000,000 to prevent ambiguity with other formats like YYYYMMDD.
(merge 4018dc29ee ls/doc-raw-timestamp-prefix later to maint).
Wording used in "format-patch --subject-prefix" documentation
has been improved.
(merge 4a1eb9304a lo/doc-format-patch-subject-prefix later to maint).
Advanced emulation of kill() used on Windows in GfW has been
upstreamed to improve the symptoms like left-behind .lock files and
that fails to let the child clean-up itself when it gets killed.
(merge 363f1d8b3a js/win-kill-child-more-gently later to maint).
The git describe --contains --all command has been fixed to
properly honor the --match and --exclude options by passing
them down to git name-rev with the appropriate reference
prefixes.
(merge 1891707d1b jk/describe-contains-all-match-fix later to maint).
Various typos, grammatical errors, and duplicated words in both
documentation and code comments have been corrected.
(merge dc6068df67 wy/docs-typofixes later to maint).
The subprocess handshake during startup has been made gentler by using
packet_read_line_gently() instead of packet_read_line() to prevent the
parent Git process from dying abruptly when a configured subprocess
(e.g., a clean/smudge filter) fails to start.
(merge 061a68e443 mm/subprocess-handshake-fix later to maint).
The TSAN race in transfer_debug() within transport-helper.c has been
resolved by initializing the debug flag early in
bidirectional_transfer_loop() before spawning worker threads, allowing
the removal of a TSAN suppression.
(merge 85704eda18 ps/transport-helper-tsan-fix later to maint).
git describe has been taught to pass the refs/tags/ prefix down to
the ref iterator when --all is not requested, avoiding unnecessary
iteration over non-tag refs.
(merge 55088ac8a4 td/describe-tag-iteration later to maint).
compute_reachable_generation_numbers() in commit-graph used a 32-bit
integer to accumulate parent generations, which is OK for generation
number v1 (topological levels), but with generation number v2
(adjusted committer timestamps), it truncated timestamps beyond
Fixed by widening the accumulator to timestamp_t.
(merge fbcc5408fc en/commit-graph-timestamp-fix later to maint).
Other code cleanup, docfix, build fix, etc.
(merge 80f4b802e9 ja/doc-difftool-synopsis-style later to maint).
(merge b96490241e jc/doc-timestamps-in-stat later to maint).
(merge ef85286e51 ss/t7004-unhide-git-failures later to maint).
(merge 7584d10bc2 mf/format-patch-cover-letter-format-docfix later to maint).
(merge 8547908eb3 pw/rename-to-get-current-worktree later to maint).
(merge 890229b3f3 sg/t6112-unwanted-tilde-expansion-fix later to maint).
(merge ab9753e7bc kh/doc-restore-double-underscores-fix later to maint).
(merge 4a9e097228 za/t2000-modernise-more later to maint).
(merge b635fd0725 kh/doc-log-decorate-list later to maint).
(merge 65ea197dca jk/commit-sign-overflow-fix later to maint).
(merge 3ccb16052a jk/apply-leakfix later to maint).
(merge 5e6e8dc786 tb/pseudo-merge-bugfixes later to maint).
(merge 6d09e798bc pb/doc-diff-format-updates later to maint).
(merge 34a891a2d3 rs/trailer-fold-optim later to maint).
(merge 499f9048e0 ps/t3903-cover-stash-include-untracked later to maint).
(merge b56ab270aa jk/sq-dequote-cleanup later to maint).
(merge 29d9fdcf10 rs/use-builtin-add-overflow-explicitly-on-clang later to
maint).
(merge d9982e8290 ed/check-connected-close-err-fd-2.53 later to maint).
(merge 1740cc35d0 ed/check-connected-close-err-fd later to maint).
(merge f4d7eb3d1c sp/doc-range-diff-takes-notes later to maint).
(merge 83e7f3bd2b kh/free-commit-list later to maint).
(merge d1b72b29e9 am/doc-tech-hash-typofix later to maint).
(merge 014c454799 ak/typofixes later to maint).
(merge 522ea8ef7d js/osxkeychain-build-wo-rust later to maint).
(merge e8f12e0e95 jc/t1400-fifo-cleanup later to maint).
(merge 0bf506efd4 kw/gitattributes-typofix later to maint).
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit bd06f92cb5284803f42ea0b61e9dc3801e4463ae
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Fri Jul 3 21:41:24 2026 +0200
fetchmail: Update to version 6.6.6
- Update from version 6.6.5 to 6.6.6
- No change to rootfile
- Changelog
6.6.6
CRITICAL BUGFIX FOR IMAP:
* The IMAP client, which has always used message indexes for the selected
mailbox, did not abort when receiving an EXPUNGE response - which changes
message numbers inside the mailbox. Unlike UIDs, the message numbers are
not stable and fetchmail does not have internal interfaces to track which
messages are deleted, and adding those to a 6.6.X release would be too
risky, and switching to UID is also too big a change, so we have no
choice but to abort the session when seeing an EXPUNGE response without
our own EXPUNGE request, to avoid marking the wrong message as seen/deleted
or skip the wrong one, or assume the wrong message size.
Earl Chew reported this versus Yahoo Mail via Gitlab Work Item #91, which
automatically expunges messages that are marked with the \Deleted flag.
This has one new message for which we do not have translations yet,
it is urgent to get the fix in the field.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit eefd1dfcf7402f8f3a720946717e76fa912da377
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Fri Jul 3 21:41:15 2026 +0200
core204: Ship curl
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit c06b4f44816f1e9e93fe465cfed00d4ef986e94f
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Fri Jul 3 21:41:23 2026 +0200
curl: Update to version 8.21.0
- Update from version 8.20.0 to 8.21.0
- No change to rootfile
- Changelog
8.21.0
Changes:
curl: named globs in output filename for upload glob references
HTTP/3: add proxy CONNECT and MASQUE CONNECT-UDP support (ngtcp2 QUIC)
http2: remove stream dependency tracking
lib: drop support for CURLAUTH_DIGEST_IE
libssh: add support for SHA256 host public keys
tool_urlglob: add named globs
Bugfixes:
_ENVIRONMENT.md. Windows does case insensitive env variables
_URL.md: remove the zone-id mention
AmigaOS: curl_setup.h avoid explicit_bzero with clib2
AmigaOS: fix build fallouts, re-add to CI
asyn-thrdd: add IPv6 guards
asyn-thrdd: fix result processing without wakeup socketpair
autotools: mbedtls detection fixes
BINDINGS: Update Hollywood link
BUFQ.md: re-sync with source code
build: enable `-Wlogical-op` picky warning for GCC 4.4+
build: omit zlib pkg-config reference for Android
cf-h2-prox: fix peer leak
cf-h2-proxy: drop interim responses
cf-https-connect: do not engage on proxy origin
cf-ip-happy.c: minor comment typo
cf-ip-happy: update documentation
cf-socket: make Curl_addr2string static
cf-socket: set scope_id for IPv6 link-local addresses
cf-socket: store errno from do_connect in ctx->error
cfilters: fix busy loop on blocked transfers
chunked: reject invalid bytes in trailer
CIPHERS.md: fix the example that uses only TLS 1.3
cmake/FindGSS: drop "MIT Unknown" version value, related tidy ups
cmake/FindGSS: drop CMake <3.16 compatibility logic
cmake/FindGSS: fix comment, adjust custom flavor property name
cmake/FindGSS: prioritize MIT over GNU in pkg-config detection
cmake: auto-select static nghttp2/nghttp3/ngtcp2 Config
cmake: export/forward `NGTCP2_CRYPTO_BACKEND`
cmake: fix three issues generating lib options in config files
cmake: fix zstd CMake config name
cmake: opt in `MSVC_VERSION` 1951 to picky warnings
cmake: quote `COMPONENTS` string in `curl-config.in.cmake`
cmake: simplify `LINK_ONLY` imported target extraction
config2setopts: use default protocol properly
connect: remove deref of freed pointer in trace call
content_encoding: fix limit failure message
content_encoding: fix non-last chunked rejection
content_encoding: timeout during slow decoding
cookie: check __Secure- and __Host- case sensitively when read from file
cookie: compare path case sensitively
cookie: reject control octets in file-loaded cookies
cookie: simplify strstore(), remove outdated comment
cookie: tailmatch the domains for secure override
cookie: trim trailing dots when checking PSL
creds: add sasl service name
creds: create with empty user+pass
creds: mask OAuth bearer token in trace logs
creds: remove two unused functions
curl_easy_pause.md: rephrase the stream cache when pause clause
curl_easy_setopt.md: change options when no transfer runs
curl_formdata: fix to pass long where missing, document `CURLFORM_NAMELENGTH`
curl_multi_assign.md: clarify lifetime
curl_ntlm_core: fix nettle 4+ builds in certain MultiSSL combos
curl_ntlm_core: propagate DES `CryptEncrypt()` error
curl_sha512_256: fix result code on error
CURLINFO_CONTENT_LENGTH_UPLOAD_T.md: expand
CURLMOPT_SOCKETFUNCTION.md: this sends *all* file descriptors
CURLOPT_CHUNK_BGN_FUNCTION: target is there for symlinks only
CURLOPT_DISALLOW_USERNAME_IN_URL: is for CURLOPT_URL only
CURLOPT_DOH_URL.md: does not inherit proxy options
CURLOPT_ECH.md: simplify the description language
CURLOPT_HAPROXYPROTOCOL.md: only sent for newly setup connections
CURLOPT_MAXFILESIZE: clarify this also works for on-going transfers
CURLOPT_PINNEDPUBLICKEY.md: does not apply for other origins
CURLOPT_PORT.md: use stronger language
CURLOPT_SHARE: warn about early remove
CURLOPT_SSH_HOSTKEYFUNCTION.md: for new connections only
CURLOPT_WRITEFUNCTION.md: mention redirects
CURLOPT_WRITEFUNCTION.md: remove stray reference to HSTS
delta: harden external command invocations
digest: escape control codes too
digest: flush proxy state on proxy or credential change
digest: flush state on origin or credential change
dns-httpsrr-lookup: use origin, not peer
dnscache: remove Curl_dns_entry_link
docs/libcurl: fix the version for curl_multi_socket_action
docs: end "...can be used several times..." sentences with period
docs: fix --follow doc typo
docs: fix a couple of typos
docs: fix grammar and wording in FAQ
docs: fix odd wording in CONTRIBUTE.md
docs: note CURLOPT_PINNEDPUBLICKEY has no effect on legacy LDAP backend
docs: returned header size reflects HTTP/1-style format
doh: cap the maximum TTL to 24 hours
doh: stricter HTTPS RNAME parsing
ECH: cleanups
event: fix wakeup consumption
ftp: avoid accessing EPSV response one byte past the NULL
ftp: remove 2 Curl_resolv_blocking() calls
ftp: remove bits.ftp_use_control_ssl
ftplistparser: clear strings.target if not symlink
gnutls: allow building with nettle 4.0
gnutls: fix more nettle 4+ compatibility issues
gnutls: require 3.7.2 for earlydata
gsasl: fix potential double free
gtls: fix ignored return and uninitialized status in OCSP check
gtls: fix some typos
gtls: minor fixes and improvements
gtls: use the correct return code in trace output
gtls: verify OCSP response signature in gtls_verify_ocsp_status
h3-proxy: fix callback return values, and a typo in tests
hostip: remove unused MAX_HOSTCACHE_LEN and MAX_DNS_CACHE_SIZE
hsts.md: mention multiple curl invokes effect
hsts: duplicate live HSTS data in curl_easy_duphandle
http-proxy: verify CONNECT response headers
HTTP3.md: update quiche build
http: don't pass on set cookies to new origins
http: prefer chunked encoding over Content-Length: 0
http: reject spurious CR bytes in headers
http_digest: return better error
idn: replace header guards with forward declaration
INSTALL-CMAKE.md: document CMake environment variables
INTERNALS.md: document minimum nghttp3 and ngtcp2 versions
KNOWN_BUGS.md: remove fixed GnuTLS <-> OpenSSL incompat bug
KNOWN_BUGS: remove stale Threads::Threads entry
krb5_sspi: fix error message on `DecryptMessage()` fail
ldap: base64 encode binary LDIF values with WinLDAP
ldap: fix minor leak on write callback error
ldap: fix to not leak `attribute` on OOM (WinLDAP)
ldap: switch off chasing referrals
lib678: fix to not be perma-skipped
lib: make `__STDC_VERSION__` literals `L` (where missing)
lib: transfer origin and proxy handling
lib: two minor typos
libcurl-easy.md: minor clarifications
libssh2: do not use deprecated macros when unavailable
libssh2: drop stray double-negative from `strncmp()` result
libssh2: fix to return error code on missing parameter
libssh2: replace macro names with non-misspelled alternatives
libssh2: save non-standard port to `known_hosts`
libssh2: sync version check with INTERNALS.md
libssh2: use non-deprecated `libssh2_knownhost_addc()`
libssh: map SSH_KNOWN_HOSTS_OTHER to CURLKHMATCH_MISMATCH
m4: drop redundant conditions in TLS library detections
Makefile.am: drop test1190 listed twice
managen: apply minor fixes and improvements
mbedtls: null-terminate the private key blob
mk-unity.pl: `#include`, and not concatenate input headers
mqtt: return error on truncated Remaining Length
mqtt: validate PINGRESP and DISCONNECT have remaining_length == 0
multi: handle pause in multi socket callback
multi: remove a stale comment
multi: silence gcc 16 `-Wnull-dereference`, bump CI job to test
multi: xfers_really_alive
netrc: remember and check filename loaded
netrc: scanner refactor
ngtcp2: fail handshake directly
openssl: do not mix OpenSSL int result with `CURLcode` variable
os400sys: fix theoretical length overflows
peer.h: fix typo in comment
pingpong: reject nul byte in server response line
progress: fix CURLINFO time reporting
psl: require libpsl 0.16.0 (2016-12-10) or greater
pytest: pass `--disable` to curl
pytest: re-enable test test_05_01 and test_05_02 for quiche 0.29.0+
pythonlint.sh: make it fail on error, fix ruff warnings in pytest
quic: count zero length packets against max
ratelimits: use minimal burst rate
RELEASE-PROCEDURE.md: update coming release dates
resolve: mention in error that IP address is expected
rtsp: bump buf after rtsp_filter_rtp()
runner.pm: apply minor correctness fix
runner.pm: set `CURL_TESTNUM` for `precheck` commands
runtests: fix tests for curl builds with embedded CA bundle
rustls: error on CURLOPT_CRLFILE with native CA store
schannel: check `schannel_sha256sum()` success, and more
schannel: enforce Extended Key Usage for custom CA roots
schannel: error on TLS 1.3-only with cipher list
schannel: fix https proxy for client cert and certinfo
schannel: fix revoke_best_effort setting for proxy
schannel: use fopen instead CreateFile
schannel_verify: avoid out of blob access
schannel_verify: simplify CryptQueryObject use
scripts: catch Credits-to contributors
SECURITY-ADVISORY.md: expand
setopt: changing the proxy port is also a proxy change
setopt: clear proxy auth properly on NULL
setopt: clear the "custom" CA booleans when set to NULL
setopt: CURLOPT_MAXCONNECTS set to 0 restores default value
setopt: defref the old referer when setting a new
setopt: fix to honor `CURLOPT_PROXY_CAINFO_BLOB` over Native CA
setopt: gate a few proxy TLS options by checking backend support
setopt: more careful cleanup of the HSTS cache
setopt: return error if received `curl_blob->data` is NULL
show-headers.md: mention bold headers and --no-styled-output
sigv4: URL encode the username in the header
smb: constify `strchr()` result variable
smb: integer overflow proof a size check
smbserver: update internal id generation for Python 3
socket: introduce `SOCK_EAGAIN()` and use it
socket: use name `sockerr` for socket error variables
socks_sspi: invalid response length is a fatal error
socks_sspi: store socks5_gssapi_enctype
spnego_sspi: honor CURLOPT_GSSAPI_DELEGATION for Windows SSPI
spnego_sspi: preserve distinction btw policy-only and uncond delegation
src: fix comment typos
src: sync nghttp2 versions checks with current requirements
ssl native_ca_store: always reinit
SSLCERTS: document 8.19.0 default Native CA builds (Windows)
sspi: clear SSPI credentials on AcquireCredentialsHandle failure
sspi: free libcurl allocated memory with curlx_free
telnet: drop an `int` cast no longer necessary
telnet: drop redundant interim variables
telnet: fix error message typos
telnet: fix old copy-paste typo in variable name
telnet: honor CURLOPT_TIMEOUT in send_telnet_data()
test1588: use %TESTNUMBER, not hard-coded number
test1981: explicitly set the locale
tests: add `cookies` feature to some tests
tests: add an assert to avoid IPC blocking
tests: add the "--resolve" keyword to tests that lack it
tests: fix unit1636 with --disable-progress-meter
tftp: avoid the timeout calc if the timeout is crazy
tftp: stricter option name checks
tidy-up: add space around operators, where missing
tidy-up: apply clang-format fixes
tidy-up: drop stray casts for allocated pointers
tidy-up: miscellaneous
tls: fix incomplete mTLS config in conn reuse and session cache
tls: wolfssl: fixes for PQC key shares
tool: warn when --ssl and --ftp-ssl-control override each other
tool_formparse.c: fix two minor comment typos
tool_formparse: polish error message + make two functions static
tool_formparse: tool2curlparts is no longer recursive
tool_help: rectify a bad assert
tool_operhlp: avoid NULL to %s
tool_urlglob: avoid overflow at end of range
tool_urlglob: better 'Duplicate glob name' position
tool_urlglob: make globbing error reported for correct position
tool_writeout: fix %time{} output for %s
transfer: clear referer when set to NULL
unit1675: fix potential memory leak on dynbuf fail path
unix-sockets: ignore proxy settings
URL-SYNTAX: document more URL parsing details
url: compare full origin when setting credentials
url: connection credentials origin
url: connection reuse fixes for starttls
url: detect proxy changes read from environment
url: don't log bits.close state
url: fix connection reuse for starttls protocols
url: keep the question mark for empty queries
url: remove superfluous check
url: url_match_destination fix
urlapi: accept 0X prefix in IPv4 address as well
urlapi: change more lowercase percent-encoded to uppercase
urlapi: compare zone-id in Curl_url_same_origin()
urlapi: consume trailing dots after IPv4 numerical addresses
urlapi: deny hostnames with more than one trailing dot
urlapi: drop base fragment on empty redirect
urlapi: fix an issue parsing file URLs
urlapi: fix memleaks on error in `parse_hostname_login()`
urlapi: fix redirect handling if CURLU_NO_GUESS_SCHEME is set
urlapi: forbid '|' in host
urlapi: handle redirect without set scheme with default-scheme
urlapi: URL decode hostname before IP address normalization
user-agent.md: mention double quotes too
var: use a dedicated pointer for the alloc
verify-release: verify more thoroughly with git
vquic: drop stray casts for `iovec.iov_len`
vtls: more large buffer support and error checks for SHA-256
vtls: use Curl_safecmp for CRLfile and pinned_key comparison
vtls_scache: include signature_algorithms in the SSL peer cache key
vtls_spack: drop redundant macro fallbacks
VULN-DISCLOSURE-POLICY.md: emphasize comm as a human
VULN-DISCLOSURE-POLICY.md: emphasize the no email thank you part
VULN-DISCLOSURE-POLICY.md: test code is not secure
VULN-DISCLOSURE-POLICY: non-released code
websockets: auto-tunnel through http proxy
websockets: buffer upgrade data at connection level
windows: update MS SDK versions in comments
winldap: avoid NULL pointer deref on `ldap_get_dn()` fail
ws: make pong sending lazy
x509asn1: fix DH public key parameter extraction
x509asn1: fix operator order in do_pubkey
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
-----------------------------------------------------------------------
Summary of changes:
config/rootfiles/common/acl | 6 +-
config/rootfiles/common/attr | 3 +-
config/rootfiles/common/glib | 16 ++---
config/rootfiles/common/json-c | 2 +-
config/rootfiles/common/libarchive | 2 +-
config/rootfiles/common/libjpeg | 2 +-
config/rootfiles/common/pango | 6 +-
config/rootfiles/common/sqlite | 2 +-
config/rootfiles/common/systemd | 11 ++-
config/rootfiles/common/vim | 16 +++++
.../{oldcore/104 => core/204}/filelists/acl | 0
.../{oldcore/106 => core/204}/filelists/attr | 0
.../{oldcore/104 => core/204}/filelists/curl | 0
.../{oldcore/118 => core/204}/filelists/glib | 0
.../{oldcore/125 => core/204}/filelists/json-c | 0
.../{oldcore/104 => core/204}/filelists/libarchive | 0
.../{oldcore/107 => core/204}/filelists/libjpeg | 0
.../{oldcore/163 => core/204}/filelists/pango | 0
.../{oldcore/199 => core/204}/filelists/systemd | 0
.../{oldcore/121 => core/204}/filelists/tar | 0
.../{oldcore/134 => core/204}/filelists/vim | 0
config/rootfiles/packages/git | 2 +
lfs/acl | 6 +-
lfs/attr | 6 +-
lfs/curl | 4 +-
lfs/fetchmail | 6 +-
lfs/git | 6 +-
lfs/glib | 4 +-
lfs/json-c | 7 +-
lfs/libarchive | 4 +-
lfs/libjpeg | 4 +-
lfs/pango | 4 +-
lfs/sqlite | 4 +-
lfs/systemd | 4 +-
lfs/tar | 5 +-
lfs/vim | 4 +-
.../json-c-0.18_allow_build_with_cmake_4.0.0.patch | 9 ---
.../tar-1.35_Avoid_acl__prefix_for_functions.patch | 83 ++++++++++++++++++++++
38 files changed, 163 insertions(+), 65 deletions(-)
copy config/rootfiles/{oldcore/104 => core/204}/filelists/acl (100%)
copy config/rootfiles/{oldcore/106 => core/204}/filelists/attr (100%)
copy config/rootfiles/{oldcore/104 => core/204}/filelists/curl (100%)
copy config/rootfiles/{oldcore/118 => core/204}/filelists/glib (100%)
copy config/rootfiles/{oldcore/125 => core/204}/filelists/json-c (100%)
copy config/rootfiles/{oldcore/104 => core/204}/filelists/libarchive (100%)
copy config/rootfiles/{oldcore/107 => core/204}/filelists/libjpeg (100%)
copy config/rootfiles/{oldcore/163 => core/204}/filelists/pango (100%)
copy config/rootfiles/{oldcore/199 => core/204}/filelists/systemd (100%)
copy config/rootfiles/{oldcore/121 => core/204}/filelists/tar (100%)
copy config/rootfiles/{oldcore/134 => core/204}/filelists/vim (100%)
delete mode 100644 src/patches/json-c-0.18_allow_build_with_cmake_4.0.0.patch
create mode 100644 src/patches/tar/tar-1.35_Avoid_acl__prefix_for_functions.patch
Difference in files:
diff --git a/config/rootfiles/common/acl b/config/rootfiles/common/acl
index 505fd563c6..9d449a60a1 100644
--- a/config/rootfiles/common/acl
+++ b/config/rootfiles/common/acl
@@ -7,7 +7,7 @@ usr/bin/setfacl
#usr/lib/libacl.la
usr/lib/libacl.so
usr/lib/libacl.so.1
-usr/lib/libacl.so.1.1.2302
+usr/lib/libacl.so.1.2.2400
#usr/lib/pkgconfig/libacl.pc
#usr/share/doc/acl
#usr/share/doc/acl/CHANGES
@@ -37,6 +37,7 @@ usr/lib/libacl.so.1.1.2302
#usr/share/man/man3/acl_copy_int.3
#usr/share/man/man3/acl_create_entry.3
#usr/share/man/man3/acl_delete_def_file.3
+#usr/share/man/man3/acl_delete_def_file_at.3
#usr/share/man/man3/acl_delete_entry.3
#usr/share/man/man3/acl_delete_perm.3
#usr/share/man/man3/acl_dup.3
@@ -45,6 +46,7 @@ usr/lib/libacl.so.1.1.2302
#usr/share/man/man3/acl_error.3
#usr/share/man/man3/acl_extended_fd.3
#usr/share/man/man3/acl_extended_file.3
+#usr/share/man/man3/acl_extended_file_at.3
#usr/share/man/man3/acl_extended_file_nofollow.3
#usr/share/man/man3/acl_free.3
#usr/share/man/man3/acl_from_mode.3
@@ -52,6 +54,7 @@ usr/lib/libacl.so.1.1.2302
#usr/share/man/man3/acl_get_entry.3
#usr/share/man/man3/acl_get_fd.3
#usr/share/man/man3/acl_get_file.3
+#usr/share/man/man3/acl_get_file_at.3
#usr/share/man/man3/acl_get_perm.3
#usr/share/man/man3/acl_get_permset.3
#usr/share/man/man3/acl_get_qualifier.3
@@ -59,6 +62,7 @@ usr/lib/libacl.so.1.1.2302
#usr/share/man/man3/acl_init.3
#usr/share/man/man3/acl_set_fd.3
#usr/share/man/man3/acl_set_file.3
+#usr/share/man/man3/acl_set_file_at.3
#usr/share/man/man3/acl_set_permset.3
#usr/share/man/man3/acl_set_qualifier.3
#usr/share/man/man3/acl_set_tag_type.3
diff --git a/config/rootfiles/common/attr b/config/rootfiles/common/attr
index 73f8e9500a..4307e1dd0a 100644
--- a/config/rootfiles/common/attr
+++ b/config/rootfiles/common/attr
@@ -1,7 +1,6 @@
usr/bin/attr
usr/bin/getfattr
usr/bin/setfattr
-#usr/etc
#usr/etc/xattr.conf
#usr/include/attr
#usr/include/attr/attributes.h
@@ -11,7 +10,7 @@ usr/bin/setfattr
#usr/lib/libattr.la
#usr/lib/libattr.so
usr/lib/libattr.so.1
-usr/lib/libattr.so.1.1.2502
+usr/lib/libattr.so.1.1.2600
#usr/lib/pkgconfig/libattr.pc
#usr/share/doc/attr
#usr/share/doc/attr/CHANGES
diff --git a/config/rootfiles/common/glib b/config/rootfiles/common/glib
index f9e0ca72a9..fd92e25ff3 100644
--- a/config/rootfiles/common/glib
+++ b/config/rootfiles/common/glib
@@ -339,22 +339,22 @@ usr/include/glib-2.0/gio/gdebugcontroller.h
#usr/lib/glib-2.0/include/glibconfig.h
#usr/lib/libgio-2.0.so
usr/lib/libgio-2.0.so.0
-usr/lib/libgio-2.0.so.0.8800.1
+usr/lib/libgio-2.0.so.0.8800.2
#usr/lib/libgirepository-2.0.so
usr/lib/libgirepository-2.0.so.0
-usr/lib/libgirepository-2.0.so.0.8800.1
+usr/lib/libgirepository-2.0.so.0.8800.2
#usr/lib/libglib-2.0.so
usr/lib/libglib-2.0.so.0
-usr/lib/libglib-2.0.so.0.8800.1
+usr/lib/libglib-2.0.so.0.8800.2
#usr/lib/libgmodule-2.0.so
usr/lib/libgmodule-2.0.so.0
-usr/lib/libgmodule-2.0.so.0.8800.1
+usr/lib/libgmodule-2.0.so.0.8800.2
#usr/lib/libgobject-2.0.so
usr/lib/libgobject-2.0.so.0
-usr/lib/libgobject-2.0.so.0.8800.1
+usr/lib/libgobject-2.0.so.0.8800.2
#usr/lib/libgthread-2.0.so
usr/lib/libgthread-2.0.so.0
-usr/lib/libgthread-2.0.so.0.8800.1
+usr/lib/libgthread-2.0.so.0.8800.2
#usr/lib/pkgconfig/gio-2.0.pc
#usr/lib/pkgconfig/gio-unix-2.0.pc
#usr/lib/pkgconfig/girepository-2.0.pc
@@ -377,8 +377,8 @@ usr/lib/libgthread-2.0.so.0.8800.1
#usr/share/gdb/auto-load
#usr/share/gdb/auto-load/usr
#usr/share/gdb/auto-load/usr/lib
-#usr/share/gdb/auto-load/usr/lib/libglib-2.0.so.0.8800.1-gdb.py
-#usr/share/gdb/auto-load/usr/lib/libgobject-2.0.so.0.8800.1-gdb.py
+#usr/share/gdb/auto-load/usr/lib/libglib-2.0.so.0.8800.2-gdb.py
+#usr/share/gdb/auto-load/usr/lib/libgobject-2.0.so.0.8800.2-gdb.py
#usr/share/gettext/its
#usr/share/gettext/its/gschema.its
#usr/share/gettext/its/gschema.loc
diff --git a/config/rootfiles/common/json-c b/config/rootfiles/common/json-c
index dbf87f32ca..c92c469370 100644
--- a/config/rootfiles/common/json-c
+++ b/config/rootfiles/common/json-c
@@ -21,5 +21,5 @@
#usr/lib/cmake/json-c/json-c-targets.cmake
#usr/lib/libjson-c.so
usr/lib/libjson-c.so.5
-usr/lib/libjson-c.so.5.4.0
+usr/lib/libjson-c.so.5.5.0
#usr/lib/pkgconfig/json-c.pc
diff --git a/config/rootfiles/common/libarchive b/config/rootfiles/common/libarchive
index e39dfb50dc..0b636a1860 100644
--- a/config/rootfiles/common/libarchive
+++ b/config/rootfiles/common/libarchive
@@ -7,7 +7,7 @@
#usr/lib/libarchive.la
#usr/lib/libarchive.so
usr/lib/libarchive.so.13
-usr/lib/libarchive.so.13.8.7
+usr/lib/libarchive.so.13.8.8
#usr/lib/pkgconfig/libarchive.pc
#usr/share/man/man1/bsdcat.1
#usr/share/man/man1/bsdcpio.1
diff --git a/config/rootfiles/common/libjpeg b/config/rootfiles/common/libjpeg
index 67fa349858..9cef3944e3 100644
--- a/config/rootfiles/common/libjpeg
+++ b/config/rootfiles/common/libjpeg
@@ -19,7 +19,7 @@ usr/lib/libjpeg.so.8
usr/lib/libjpeg.so.8.3.2
#usr/lib/libturbojpeg.so
usr/lib/libturbojpeg.so.0
-usr/lib/libturbojpeg.so.0.4.0
+usr/lib/libturbojpeg.so.0.5.0
#usr/lib/pkgconfig/libjpeg.pc
#usr/lib/pkgconfig/libturbojpeg.pc
#usr/share/doc/libjpeg-turbo
diff --git a/config/rootfiles/common/pango b/config/rootfiles/common/pango
index 3496adbad1..53f3d6b9dc 100644
--- a/config/rootfiles/common/pango
+++ b/config/rootfiles/common/pango
@@ -41,13 +41,13 @@ usr/bin/pango-view
#usr/include/pango-1.0/pango/pangoft2.h
#usr/lib/libpango-1.0.so
usr/lib/libpango-1.0.so.0
-usr/lib/libpango-1.0.so.0.5701.0
+usr/lib/libpango-1.0.so.0.5800.0
#usr/lib/libpangocairo-1.0.so
usr/lib/libpangocairo-1.0.so.0
-usr/lib/libpangocairo-1.0.so.0.5701.0
+usr/lib/libpangocairo-1.0.so.0.5800.0
#usr/lib/libpangoft2-1.0.so
usr/lib/libpangoft2-1.0.so.0
-usr/lib/libpangoft2-1.0.so.0.5701.0
+usr/lib/libpangoft2-1.0.so.0.5800.0
#usr/lib/pkgconfig/pango.pc
#usr/lib/pkgconfig/pangocairo.pc
#usr/lib/pkgconfig/pangofc.pc
diff --git a/config/rootfiles/common/sqlite b/config/rootfiles/common/sqlite
index 5ae88c4a35..f12ed80eae 100644
--- a/config/rootfiles/common/sqlite
+++ b/config/rootfiles/common/sqlite
@@ -3,6 +3,6 @@ usr/bin/sqlite3
#usr/include/sqlite3ext.h
usr/lib/libsqlite3.so
usr/lib/libsqlite3.so.0
-usr/lib/libsqlite3.so.3.53.2
+usr/lib/libsqlite3.so.3.53.3
#usr/lib/pkgconfig/sqlite3.pc
#usr/share/man/man1/sqlite3.1
diff --git a/config/rootfiles/common/systemd b/config/rootfiles/common/systemd
index 965d2fe3ff..983001384b 100644
--- a/config/rootfiles/common/systemd
+++ b/config/rootfiles/common/systemd
@@ -19,16 +19,18 @@ usr/bin/udev-hwdb
#usr/include/systemd/sd-dhcp-client.h
#usr/include/systemd/sd-dhcp-duid.h
#usr/include/systemd/sd-dhcp-lease.h
-#usr/include/systemd/sd-dhcp-option.h
#usr/include/systemd/sd-dhcp-protocol.h
+#usr/include/systemd/sd-dhcp-relay.h
#usr/include/systemd/sd-dhcp-server-lease.h
#usr/include/systemd/sd-dhcp-server.h
#usr/include/systemd/sd-dhcp6-client.h
#usr/include/systemd/sd-dhcp6-lease.h
#usr/include/systemd/sd-dhcp6-option.h
#usr/include/systemd/sd-dhcp6-protocol.h
+#usr/include/systemd/sd-dlopen.h
#usr/include/systemd/sd-dns-resolver.h
#usr/include/systemd/sd-event.h
+#usr/include/systemd/sd-future.h
#usr/include/systemd/sd-gpt.h
#usr/include/systemd/sd-hwdb.h
#usr/include/systemd/sd-id128.h
@@ -56,10 +58,10 @@ usr/bin/udev-hwdb
#usr/include/systemd/sd-varlink.h
#usr/lib/libsystemd.so
usr/lib/libsystemd.so.0
-usr/lib/libsystemd.so.0.43.0
+usr/lib/libsystemd.so.0.44.0
#usr/lib/libudev.so
usr/lib/libudev.so.1
-usr/lib/libudev.so.1.7.13
+usr/lib/libudev.so.1.7.14
#usr/lib/pkgconfig/libsystemd.pc
#usr/lib/pkgconfig/libudev.pc
usr/lib/udev
@@ -80,6 +82,7 @@ usr/lib/udev/hwdb.d/20-sdio-vendor-model.hwdb
usr/lib/udev/hwdb.d/20-usb-classes.hwdb
usr/lib/udev/hwdb.d/20-usb-vendor-model.hwdb
usr/lib/udev/hwdb.d/20-vmbus-class.hwdb
+usr/lib/udev/hwdb.d/40-imds.hwdb
usr/lib/udev/hwdb.d/60-autosuspend-chromiumos.hwdb
usr/lib/udev/hwdb.d/60-autosuspend-fingerprint-reader.hwdb
usr/lib/udev/hwdb.d/60-autosuspend.hwdb
@@ -92,6 +95,7 @@ usr/lib/udev/hwdb.d/60-tpm2.hwdb
usr/lib/udev/hwdb.d/70-analyzers.hwdb
usr/lib/udev/hwdb.d/70-av-production.hwdb
usr/lib/udev/hwdb.d/70-cameras.hwdb
+usr/lib/udev/hwdb.d/70-debug-appliance.hwdb
usr/lib/udev/hwdb.d/70-hardware-wallets.hwdb
usr/lib/udev/hwdb.d/70-joystick.hwdb
usr/lib/udev/hwdb.d/70-lights.hwdb
@@ -102,6 +106,7 @@ usr/lib/udev/hwdb.d/70-pointingstick.hwdb
usr/lib/udev/hwdb.d/70-software-radio.hwdb
usr/lib/udev/hwdb.d/70-sound-card.hwdb
usr/lib/udev/hwdb.d/70-touchpad.hwdb
+usr/lib/udev/hwdb.d/70-vsock.hwdb
usr/lib/udev/hwdb.d/80-ieee1394-unit-function.hwdb
usr/lib/udev/hwdb.d/82-net-auto-link-local.hwdb
usr/lib/udev/hwdb.d/README
diff --git a/config/rootfiles/common/vim b/config/rootfiles/common/vim
index 49584d6dd1..322aa52d83 100644
--- a/config/rootfiles/common/vim
+++ b/config/rootfiles/common/vim
@@ -41,6 +41,8 @@ usr/share/vim
#usr/share/vim/vim92/autoload/RstFold.vim
#usr/share/vim/vim92/autoload/ada.vim
#usr/share/vim/vim92/autoload/adacomplete.vim
+#usr/share/vim/vim92/autoload/beancount.vim
+#usr/share/vim/vim92/autoload/beancountcomplete.vim
#usr/share/vim/vim92/autoload/bitbake.vim
#usr/share/vim/vim92/autoload/cargo
#usr/share/vim/vim92/autoload/cargo.vim
@@ -152,6 +154,7 @@ usr/share/vim
#usr/share/vim/vim92/compiler/bash.vim
#usr/share/vim/vim92/compiler/bcc.vim
#usr/share/vim/vim92/compiler/bdf.vim
+#usr/share/vim/vim92/compiler/bean_check.vim
#usr/share/vim/vim92/compiler/biome.vim
#usr/share/vim/vim92/compiler/cabal.vim
#usr/share/vim/vim92/compiler/cargo.vim
@@ -476,6 +479,7 @@ usr/share/vim
#usr/share/vim/vim92/ftplugin/bash.vim
#usr/share/vim/vim92/ftplugin/basic.vim
#usr/share/vim/vim92/ftplugin/bdf.vim
+#usr/share/vim/vim92/ftplugin/beancount.vim
#usr/share/vim/vim92/ftplugin/bicep-params.vim
#usr/share/vim/vim92/ftplugin/bicep.vim
#usr/share/vim/vim92/ftplugin/bindzone.vim
@@ -834,6 +838,7 @@ usr/share/vim
#usr/share/vim/vim92/ftplugin/tiasm.vim
#usr/share/vim/vim92/ftplugin/tidy.vim
#usr/share/vim/vim92/ftplugin/tmux.vim
+#usr/share/vim/vim92/ftplugin/tolk.vim
#usr/share/vim/vim92/ftplugin/toml.vim
#usr/share/vim/vim92/ftplugin/treetop.vim
#usr/share/vim/vim92/ftplugin/tt2html.vim
@@ -899,12 +904,14 @@ usr/share/vim
#usr/share/vim/vim92/indent/awk.vim
#usr/share/vim/vim92/indent/bash.vim
#usr/share/vim/vim92/indent/basic.vim
+#usr/share/vim/vim92/indent/beancount.vim
#usr/share/vim/vim92/indent/bib.vim
#usr/share/vim/vim92/indent/bitbake.vim
#usr/share/vim/vim92/indent/bpftrace.vim
#usr/share/vim/vim92/indent/bst.vim
#usr/share/vim/vim92/indent/bzl.vim
#usr/share/vim/vim92/indent/c.vim
+#usr/share/vim/vim92/indent/cabal.vim
#usr/share/vim/vim92/indent/cdl.vim
#usr/share/vim/vim92/indent/ch.vim
#usr/share/vim/vim92/indent/chaiscript.vim
@@ -970,6 +977,7 @@ usr/share/vim
#usr/share/vim/vim92/indent/jsp.vim
#usr/share/vim/vim92/indent/julia.vim
#usr/share/vim/vim92/indent/just.vim
+#usr/share/vim/vim92/indent/karel.vim
#usr/share/vim/vim92/indent/kdl.vim
#usr/share/vim/vim92/indent/kotlin.vim
#usr/share/vim/vim92/indent/krl.vim
@@ -1341,6 +1349,7 @@ usr/share/vim
#usr/share/vim/vim92/syntax/basic.vim
#usr/share/vim/vim92/syntax/bc.vim
#usr/share/vim/vim92/syntax/bdf.vim
+#usr/share/vim/vim92/syntax/beancount.vim
#usr/share/vim/vim92/syntax/bib.vim
#usr/share/vim/vim92/syntax/bindzone.vim
#usr/share/vim/vim92/syntax/bitbake.vim
@@ -1867,6 +1876,7 @@ usr/share/vim
#usr/share/vim/vim92/syntax/services.vim
#usr/share/vim/vim92/syntax/setserial.vim
#usr/share/vim/vim92/syntax/sexplib.vim
+#usr/share/vim/vim92/syntax/sgf.vim
#usr/share/vim/vim92/syntax/sgml.vim
#usr/share/vim/vim92/syntax/sgmldecl.vim
#usr/share/vim/vim92/syntax/sgmllnx.vim
@@ -1927,8 +1937,12 @@ usr/share/vim
#usr/share/vim/vim92/syntax/srec.vim
#usr/share/vim/vim92/syntax/srt.vim
#usr/share/vim/vim92/syntax/ssa.vim
+#usr/share/vim/vim92/syntax/sshallowedsigners.vim
+#usr/share/vim/vim92/syntax/sshauthorizedkeys.vim
#usr/share/vim/vim92/syntax/sshconfig.vim
#usr/share/vim/vim92/syntax/sshdconfig.vim
+#usr/share/vim/vim92/syntax/sshknownhosts.vim
+#usr/share/vim/vim92/syntax/sshpublickey.vim
#usr/share/vim/vim92/syntax/st.vim
#usr/share/vim/vim92/syntax/stata.vim
#usr/share/vim/vim92/syntax/stp.vim
@@ -1975,6 +1989,7 @@ usr/share/vim
#usr/share/vim/vim92/syntax/tilde.vim
#usr/share/vim/vim92/syntax/tli.vim
#usr/share/vim/vim92/syntax/tmux.vim
+#usr/share/vim/vim92/syntax/tolk.vim
#usr/share/vim/vim92/syntax/toml.vim
#usr/share/vim/vim92/syntax/tpp.vim
#usr/share/vim/vim92/syntax/trasys.vim
@@ -2093,6 +2108,7 @@ usr/share/vim
#usr/share/vim/vim92/tools/xcmdsrv_client.c
#usr/share/vim/vim92/tutor
#usr/share/vim/vim92/tutor/README.el.txt
+#usr/share/vim/vim92/tutor/README.it.txt
#usr/share/vim/vim92/tutor/README.ru.txt
#usr/share/vim/vim92/tutor/README.sv.txt
#usr/share/vim/vim92/tutor/README.txt
diff --git a/config/rootfiles/core/204/filelists/acl b/config/rootfiles/core/204/filelists/acl
new file mode 120000
index 0000000000..d819f9c480
--- /dev/null
+++ b/config/rootfiles/core/204/filelists/acl
@@ -0,0 +1 @@
+../../../common/acl
\ No newline at end of file
diff --git a/config/rootfiles/core/204/filelists/attr b/config/rootfiles/core/204/filelists/attr
new file mode 120000
index 0000000000..c80801751f
--- /dev/null
+++ b/config/rootfiles/core/204/filelists/attr
@@ -0,0 +1 @@
+../../../common/attr
\ No newline at end of file
diff --git a/config/rootfiles/core/204/filelists/curl b/config/rootfiles/core/204/filelists/curl
new file mode 120000
index 0000000000..4b84bef53a
--- /dev/null
+++ b/config/rootfiles/core/204/filelists/curl
@@ -0,0 +1 @@
+../../../common/curl
\ No newline at end of file
diff --git a/config/rootfiles/core/204/filelists/glib b/config/rootfiles/core/204/filelists/glib
new file mode 120000
index 0000000000..44665746ad
--- /dev/null
+++ b/config/rootfiles/core/204/filelists/glib
@@ -0,0 +1 @@
+../../../common/glib
\ No newline at end of file
diff --git a/config/rootfiles/core/204/filelists/json-c b/config/rootfiles/core/204/filelists/json-c
new file mode 120000
index 0000000000..2da263e3db
--- /dev/null
+++ b/config/rootfiles/core/204/filelists/json-c
@@ -0,0 +1 @@
+../../../common/json-c
\ No newline at end of file
diff --git a/config/rootfiles/core/204/filelists/libarchive b/config/rootfiles/core/204/filelists/libarchive
new file mode 120000
index 0000000000..551f1f7434
--- /dev/null
+++ b/config/rootfiles/core/204/filelists/libarchive
@@ -0,0 +1 @@
+../../../common/libarchive
\ No newline at end of file
diff --git a/config/rootfiles/core/204/filelists/libjpeg b/config/rootfiles/core/204/filelists/libjpeg
new file mode 120000
index 0000000000..3b1a782fb1
--- /dev/null
+++ b/config/rootfiles/core/204/filelists/libjpeg
@@ -0,0 +1 @@
+../../../common/libjpeg
\ No newline at end of file
diff --git a/config/rootfiles/core/204/filelists/pango b/config/rootfiles/core/204/filelists/pango
new file mode 120000
index 0000000000..6c37231c7e
--- /dev/null
+++ b/config/rootfiles/core/204/filelists/pango
@@ -0,0 +1 @@
+../../../common/pango
\ No newline at end of file
diff --git a/config/rootfiles/core/204/filelists/systemd b/config/rootfiles/core/204/filelists/systemd
new file mode 120000
index 0000000000..f5616415e6
--- /dev/null
+++ b/config/rootfiles/core/204/filelists/systemd
@@ -0,0 +1 @@
+../../../common/systemd
\ No newline at end of file
diff --git a/config/rootfiles/core/204/filelists/tar b/config/rootfiles/core/204/filelists/tar
new file mode 120000
index 0000000000..3e585d2ebe
--- /dev/null
+++ b/config/rootfiles/core/204/filelists/tar
@@ -0,0 +1 @@
+../../../common/tar
\ No newline at end of file
diff --git a/config/rootfiles/core/204/filelists/vim b/config/rootfiles/core/204/filelists/vim
new file mode 120000
index 0000000000..98613172e3
--- /dev/null
+++ b/config/rootfiles/core/204/filelists/vim
@@ -0,0 +1 @@
+../../../common/vim
\ No newline at end of file
diff --git a/config/rootfiles/packages/git b/config/rootfiles/packages/git
index e39c7b1eb7..ef88227d3a 100644
--- a/config/rootfiles/packages/git
+++ b/config/rootfiles/packages/git
@@ -65,6 +65,7 @@ usr/libexec/git-core/git-fmt-merge-msg
usr/libexec/git-core/git-for-each-ref
usr/libexec/git-core/git-for-each-repo
usr/libexec/git-core/git-format-patch
+usr/libexec/git-core/git-format-rev
usr/libexec/git-core/git-fsck
usr/libexec/git-core/git-fsck-objects
usr/libexec/git-core/git-fsmonitor--daemon
@@ -178,6 +179,7 @@ usr/libexec/git-core/git-update-ref
usr/libexec/git-core/git-update-server-info
usr/libexec/git-core/git-upload-archive
usr/libexec/git-core/git-upload-pack
+usr/libexec/git-core/git-url-parse
usr/libexec/git-core/git-var
usr/libexec/git-core/git-verify-commit
usr/libexec/git-core/git-verify-pack
diff --git a/lfs/acl b/lfs/acl
index b0008d4db9..9b6f90b96d 100644
--- a/lfs/acl
+++ b/lfs/acl
@@ -1,7 +1,7 @@
###############################################################################
# #
# IPFire.org - A linux based firewall #
-# Copyright (C) 2007-2024 IPFire Team <info@ipfire.org> #
+# Copyright (C) 2007-2026 IPFire Team <info@ipfire.org> #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
@@ -24,7 +24,7 @@
include Config
-VER = 2.3.2
+VER = 2.4.0
THISAPP = acl-$(VER)
DL_FILE = $(THISAPP).tar.xz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 9f2abfddcd403df2c716c05f02a1b52453613d10948dc58a65b9ef41b44e37db6de99fb22dcfc4f6f0fb5d0319c939da61bd4e0fba2cdb5643e8087ecd34eeac
+$(DL_FILE)_BLAKE2 = c7e4cd5dc482b1e9e283ca0ec6740cd1051d23e9cb533917e3d58e8d2381af516bb74d340f195a5e38f9f76466406a7b2e8f31dff5362ae2cc09e9d1f47eeec7
install : $(TARGET)
diff --git a/lfs/attr b/lfs/attr
index 8a85b109ed..2c005d7b32 100644
--- a/lfs/attr
+++ b/lfs/attr
@@ -1,7 +1,7 @@
###############################################################################
# #
# IPFire.org - A linux based firewall #
-# Copyright (C) 2007-2024 IPFire Team <info@ipfire.org> #
+# Copyright (C) 2007-2026 IPFire Team <info@ipfire.org> #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
@@ -24,7 +24,7 @@
include Config
-VER = 2.5.2
+VER = 2.6.0
THISAPP = attr-$(VER)
DL_FILE = $(THISAPP).tar.xz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = cf26348c3a96622e4f62493ac7655e14b6580d36a5784ef4c3750178856eceabd33192fd58516be21c8aa1ad41d56c024ad440ef4bc922bed8f7a4984ea16c63
+$(DL_FILE)_BLAKE2 = 10e36188a11344e1cc1dd7d0bcc8724a62bfc945799755cff6a54fff6c6d7e306596628fca4f882e84a156cf2ea790a1a8411599819de4e60b0a21dc3b400d64
install : $(TARGET)
diff --git a/lfs/curl b/lfs/curl
index 3e5b78ecc0..b41766a079 100644
--- a/lfs/curl
+++ b/lfs/curl
@@ -24,7 +24,7 @@
include Config
-VER = 8.20.0
+VER = 8.21.0
THISAPP = curl-$(VER)
DL_FILE = $(THISAPP).tar.xz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 5b61a1099212af9b3c18629fd0b6c93881014e7b02ed5171021a2a074a87786ff8f8e94a47c53c3ca83354cfbe74f7d917cae819c97011c0ff9e4ace014e01c2
+$(DL_FILE)_BLAKE2 = 230989e586a592b2aee768a1a6d48f1c8247e4d26afd0787a94f45faa9fbebcda5c9a8e2b739fb5a2ada151c13b09a8e2319825e9314fcc894377f24e92d338f
install : $(TARGET)
diff --git a/lfs/fetchmail b/lfs/fetchmail
index e3d4e1dd06..4b5fc42d73 100644
--- a/lfs/fetchmail
+++ b/lfs/fetchmail
@@ -26,7 +26,7 @@ include Config
SUMMARY = Full-Featured POP and IMAP Mail Retrieval Daemon
-VER = 6.6.5
+VER = 6.6.6
THISAPP = fetchmail-$(VER)
DL_FILE = $(THISAPP).tar.xz
@@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE)
DIR_APP = $(DIR_SRC)/$(THISAPP)
TARGET = $(DIR_INFO)/$(THISAPP)
PROG = fetchmail
-PAK_VER = 25
+PAK_VER = 26
DEPS =
@@ -48,7 +48,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = cceb7a0673f6aea76fe5619c0b6a4cd25566adc31b8d9a8e574b3abf8584107b882f71a63d5690ce76822044cc8a2dd431e44813002740ebcbd3cc55b4e9105f
+$(DL_FILE)_BLAKE2 = 0f7a26a2f34d902d30801d5016e67697877f7c3f41dc9d9c4a1b44420c9e08f6acd94853c298b2938b9ddf08b3aa3115a14917f42d680f3ada8daba0e5f50953
install : $(TARGET)
diff --git a/lfs/git b/lfs/git
index 74a23d38a5..461f6a1306 100644
--- a/lfs/git
+++ b/lfs/git
@@ -24,7 +24,7 @@
include Config
-VER = 2.54.0
+VER = 2.55.0
SUMMARY = Fast, scalable, distributed revision control system
THISAPP = git-$(VER)
@@ -33,7 +33,7 @@ DL_FROM = $(URL_IPFIRE)
DIR_APP = $(DIR_SRC)/$(THISAPP)
TARGET = $(DIR_INFO)/$(THISAPP)
PROG = git
-PAK_VER = 42
+PAK_VER = 43
DEPS = perl-Authen-SASL perl-Net-SMTP-SSL
@@ -47,7 +47,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 68ee0623ff5a695a35dae2f31e3f410ebd4b6a8296c7c9fd03f53668878e9164b78ca82869c8a0719b3fae981f514f2022c45b39df7174b5e883348bdd269a82
+$(DL_FILE)_BLAKE2 = 7666d99f1002a20ec3ca89fdfcbe1156cf6ed3bbc3823a8e7903d0ff177db91ce1309cf17466d813338e83d9782f748b1dc450ce3fa8bae82211a61042acea26
install : $(TARGET)
diff --git a/lfs/glib b/lfs/glib
index 47fe1eb6b5..20f79571e2 100644
--- a/lfs/glib
+++ b/lfs/glib
@@ -24,7 +24,7 @@
include Config
-VER = 2.88.1
+VER = 2.88.2
# https://download.gnome.org/sources/glib/
THISAPP = glib-$(VER)
@@ -41,7 +41,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = d9a0e54d2c1b5128aee76f1743cbeea84a24af5a2252ba1c649943bbca3fbc5f08896249542526560c92dd0e60cbd8a72498c3cfe1535d1f0bf85316ce37dba1
+$(DL_FILE)_BLAKE2 = fecce4ad82e62e429d30f4e9050a83b53715644fc8c7c89d767ecdaefa603530e81e024dd3450ce25bcd93b00fa6aeb8551b6240d3a04862dadeb895b0177e10
install : $(TARGET)
diff --git a/lfs/json-c b/lfs/json-c
index 2669e3825d..b988e0b0fb 100644
--- a/lfs/json-c
+++ b/lfs/json-c
@@ -1,7 +1,7 @@
###############################################################################
# #
# IPFire.org - A linux based firewall #
-# Copyright (C) 2007-2025 IPFire Team <info@ipfire.org> #
+# Copyright (C) 2007-2026 IPFire Team <info@ipfire.org> #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
@@ -24,7 +24,7 @@
include Config
-VER = 0.18
+VER = 0.19
THISAPP = json-c-$(VER)
DL_FILE = $(THISAPP).tar.gz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = d39bab289976cb2f76bcf3ad8254f7f5b4d11e2aa4dedebd60dc7d131a3f6ec57beacdc575aeeb191cf449d16c549d424172e78464731eeb66305f47f72371c2
+$(DL_FILE)_BLAKE2 = 9d0d96520f6c3f8708d2ff3dd98de49b34982b88e8b3eecd5bb706a2fbca0dd79b23a40b4e30efb6162dd96ffaf986580814826627dda4719e61b727402911c7
install : $(TARGET)
@@ -73,7 +73,6 @@ $(subst %,%_BLAKE2,$(objects)) :
$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
@$(PREBUILD)
@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE)
- cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/json-c-0.18_allow_build_with_cmake_4.0.0.patch
cd $(DIR_APP) && mkdir -pv build
cd $(DIR_APP)/build && cmake .. \
-DCMAKE_INSTALL_PREFIX=/usr \
diff --git a/lfs/libarchive b/lfs/libarchive
index bb84841ffd..08c1ce689c 100644
--- a/lfs/libarchive
+++ b/lfs/libarchive
@@ -24,7 +24,7 @@
include Config
-VER = 3.8.7
+VER = 3.8.8
THISAPP = libarchive-$(VER)
DL_FILE = $(THISAPP).tar.xz
@@ -41,7 +41,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 6ed65a679b0c55e66410454de2865e8de67eb668845ac007c7d555d6023390cf95fb93ae3d006e9fef73314f8d7c3dcb8a4a44548e48e418c4d30e15b922e828
+$(DL_FILE)_BLAKE2 = dc210097fbd6bf2db240699dc2ad9fc6030b4179ffc02fa1de96537eb59897d964470fb1a675c76bc0691aa2f138f5cb2479495ea904124c80297c7bd84effc6
install : $(TARGET)
diff --git a/lfs/libjpeg b/lfs/libjpeg
index b03f795cf9..4dcfaf4f0f 100644
--- a/lfs/libjpeg
+++ b/lfs/libjpeg
@@ -24,7 +24,7 @@
include Config
-VER = 3.1.4.1
+VER = 3.2.0
THISAPP = libjpeg-turbo-$(VER)
DL_FILE = $(THISAPP).tar.gz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 7e38379b4e3bb168e6ec081be5852f9a7f4680929d42e5cccb0c00632130eee9200afdc9c2ed99250c3ddfc1cd8dd21f60da54e6c48157884c9173ae1b3f9a9f
+$(DL_FILE)_BLAKE2 = c50c985f8b870ab6467181f69e10f3ec2705cb349613b9178b293f136063e302087832d87f793b3d24ab721a2f5d76271760bd244d0766ab3b8cbe48ebf50cfa
install : $(TARGET)
diff --git a/lfs/pango b/lfs/pango
index d78ea27ef8..df7a1277e3 100644
--- a/lfs/pango
+++ b/lfs/pango
@@ -24,7 +24,7 @@
include Config
-VER = 1.57.1
+VER = 1.58.0
# https://download.gnome.org/sources/pango/
THISAPP = pango-$(VER)
@@ -41,7 +41,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 9b07a13c35a4b26df12ff720f727e54b4393640cd85a87253d1446eaa97d23d6c2ee3d09a7bb2379666cbb1097065f9aa20ec32bfe046c60c85e8bbb63fc65a8
+$(DL_FILE)_BLAKE2 = f8adae8198ac56d791ac9f5b95741f78826ff9cee3f67f831b838e5a6a3218f7fd9419a91c564eee7625ddbc1ec6ba0139e8870f3487c38aaa7123e155abcefd
install : $(TARGET)
diff --git a/lfs/sqlite b/lfs/sqlite
index 90309e571e..50e6e6525c 100644
--- a/lfs/sqlite
+++ b/lfs/sqlite
@@ -24,7 +24,7 @@
include Config
-VER = 3530200
+VER = 3530300
THISAPP = sqlite-autoconf-$(VER)
DL_FILE = $(THISAPP).tar.gz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 161b1e3e2fa6bf078d664a3ff966759f5be65a61e60748a81562782c28ac4b4e366a0f7a9f6da26c150b0a0a586d7bceb76322455f6ffbd276de92d19c133909
+$(DL_FILE)_BLAKE2 = 61ee1a88258fdfed02c51c9b0302a0eb27e58b90b5285be6e89753293f1662caa0a7d6de586bdfd72ddeffe166a0704702bed99040d2998674b22289718f3935
install : $(TARGET)
diff --git a/lfs/systemd b/lfs/systemd
index 46f873b04e..446e397df3 100644
--- a/lfs/systemd
+++ b/lfs/systemd
@@ -24,7 +24,7 @@
include Config
-VER = 260.1
+VER = 261.1
THISAPP = systemd-$(VER)
DL_FILE = $(THISAPP).tar.gz
@@ -50,7 +50,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 072424e7288f8796be1e6952fadc5452c2ab54633b356796a29872609a03b4cc2edbc0cac0df7542bc969b06d265d2cbf52f9174742c5a570a5a3d7a7664cfa8
+$(DL_FILE)_BLAKE2 = ab345d6ae27d361aa56d3b021263e2b2e3af76cdc37ee9015932557f1b904f2e5e5a6d5911b4a442057d12d5eedf8a702a30aa13f9b68294ccc14833f397a0ea
install : $(TARGET)
diff --git a/lfs/tar b/lfs/tar
index 745b658e7e..b4e8ff6561 100644
--- a/lfs/tar
+++ b/lfs/tar
@@ -1,7 +1,7 @@
###############################################################################
# #
# IPFire.org - A linux based firewall #
-# Copyright (C) 2007-2023 IPFire Team <info@ipfire.org> #
+# Copyright (C) 2007-2026 IPFire Team <info@ipfire.org> #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
@@ -80,9 +80,8 @@ $(subst %,%_BLAKE2,$(objects)) :
$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
@$(PREBUILD)
@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE)
-
cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/tar/01_extract.c.patch
-
+ cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/tar/tar-1.35_Avoid_acl__prefix_for_functions.patch
cd $(DIR_APP) && ./configure $(EXTRA_CONFIG) FORCE_UNSAFE_CONFIGURE=1
cd $(DIR_APP) && make $(MAKETUNING)
cd $(DIR_APP) && make install
diff --git a/lfs/vim b/lfs/vim
index 8d232a1a83..a389c39950 100644
--- a/lfs/vim
+++ b/lfs/vim
@@ -24,7 +24,7 @@
include Config
-VER = 9.2.0526
+VER = 9.2.0769
THISAPP = vim-$(VER)
DL_FILE = $(THISAPP).tar.gz
@@ -44,7 +44,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 0768ae9f4649bd3f5629138505e35f9aa16a6b70977abd0ef1f1398141dca8ce5b0912dbbc5f5d87bc179ff67c542aed8ec1f751da49633b2066a2b973a1f4e9
+$(DL_FILE)_BLAKE2 = 99a2221fd39bab66365980a76f2c0fc14e2d1c7518e6b03806f11a5da55cceaaadbc2291ce5a9e67be2913d2f9f5937961d87dfb61c1d77559e57c9e51464017
install : $(TARGET)
diff --git a/src/patches/json-c-0.18_allow_build_with_cmake_4.0.0.patch b/src/patches/json-c-0.18_allow_build_with_cmake_4.0.0.patch
deleted file mode 100644
index faff25de59..0000000000
--- a/src/patches/json-c-0.18_allow_build_with_cmake_4.0.0.patch
+++ /dev/null
@@ -1,9 +0,0 @@
---- json-c-0.18/apps/CMakeLists.txt.orig 2024-09-15 18:15:01.000000000 +0200
-+++ json-c-0.18/apps/CMakeLists.txt 2025-05-06 19:08:35.807635404 +0200
-@@ -1,5 +1,5 @@
-
--cmake_minimum_required(VERSION 2.8) # see ../CMakeLists.txt for why 2.8
-+cmake_minimum_required(VERSION 3.9...3.12)
-
- if(POLICY CMP0075)
- cmake_policy(SET CMP0075 NEW)
diff --git a/src/patches/tar/tar-1.35_Avoid_acl__prefix_for_functions.patch b/src/patches/tar/tar-1.35_Avoid_acl__prefix_for_functions.patch
new file mode 100644
index 0000000000..66788ce777
--- /dev/null
+++ b/src/patches/tar/tar-1.35_Avoid_acl__prefix_for_functions.patch
@@ -0,0 +1,83 @@
+--- tar-1.35/src/xattrs.c.orig 2023-07-10 09:29:17.000000000 +0200
++++ tar-1.35/src/xattrs.c 2026-07-04 13:16:07.585006365 +0200
+@@ -139,13 +139,13 @@
+ #ifdef HAVE_POSIX_ACLS
+
+ /* acl-at wrappers, TODO: move to gnulib in future? */
+-static acl_t acl_get_file_at (int, const char *, acl_type_t);
+-static int acl_set_file_at (int, const char *, acl_type_t, acl_t);
++static acl_t tar_acl_get_file_at (int, const char *, acl_type_t);
++static int tar_acl_set_file_at (int, const char *, acl_type_t, acl_t);
+ static int file_has_acl_at (int, char const *, struct stat const *);
+-static int acl_delete_def_file_at (int, char const *);
++static int tar_acl_delete_def_file_at (int, char const *);
+
+-/* acl_get_file_at */
+-#define AT_FUNC_NAME acl_get_file_at
++/* tar_acl_get_file_at */
++#define AT_FUNC_NAME tar_acl_get_file_at
+ #define AT_FUNC_RESULT acl_t
+ #define AT_FUNC_FAIL (acl_t)NULL
+ #define AT_FUNC_F1 acl_get_file
+@@ -159,8 +159,8 @@
+ #undef AT_FUNC_POST_FILE_PARAM_DECLS
+ #undef AT_FUNC_POST_FILE_ARGS
+
+-/* acl_set_file_at */
+-#define AT_FUNC_NAME acl_set_file_at
++/* tar_acl_set_file_at */
++#define AT_FUNC_NAME tar_acl_set_file_at
+ #define AT_FUNC_F1 acl_set_file
+ #define AT_FUNC_POST_FILE_PARAM_DECLS , acl_type_t type, acl_t acl
+ #define AT_FUNC_POST_FILE_ARGS , type, acl
+@@ -170,8 +170,8 @@
+ #undef AT_FUNC_POST_FILE_PARAM_DECLS
+ #undef AT_FUNC_POST_FILE_ARGS
+
+-/* acl_delete_def_file_at */
+-#define AT_FUNC_NAME acl_delete_def_file_at
++/* tar_acl_delete_def_file_at */
++#define AT_FUNC_NAME tar_acl_delete_def_file_at
+ #define AT_FUNC_F1 acl_delete_def_file
+ #define AT_FUNC_POST_FILE_PARAM_DECLS
+ #define AT_FUNC_POST_FILE_ARGS
+@@ -299,10 +299,10 @@
+ /* No "default" IEEE 1003.1e ACL set for directory. At this moment,
+ FILE_NAME may already have inherited default acls from parent
+ directory; clean them up. */
+- if (acl_delete_def_file_at (chdir_fd, file_name))
++ if (tar_acl_delete_def_file_at (chdir_fd, file_name))
+ WARNOPT (WARN_XATTR_WRITE,
+ (0, errno,
+- _("acl_delete_def_file_at: Cannot drop default POSIX ACLs "
++ _("tar_acl_delete_def_file_at: Cannot drop default POSIX ACLs "
+ "for file '%s'"),
+ file_name));
+ return;
+@@ -316,11 +316,11 @@
+ return;
+ }
+
+- if (acl_set_file_at (chdir_fd, file_name, type, acl) == -1)
++ if (tar_acl_set_file_at (chdir_fd, file_name, type, acl) == -1)
+ /* warn even if filesystem does not support acls */
+ WARNOPT (WARN_XATTR_WRITE,
+ (0, errno,
+- _ ("acl_set_file_at: Cannot set POSIX ACLs for file '%s'"),
++ _ ("tar_acl_set_file_at: Cannot set POSIX ACLs for file '%s'"),
+ file_name));
+
+ acl_free (acl);
+@@ -357,10 +357,10 @@
+ char *val = NULL;
+ acl_t acl;
+
+- if (!(acl = acl_get_file_at (parentfd, file_name, type)))
++ if (!(acl = tar_acl_get_file_at (parentfd, file_name, type)))
+ {
+ if (errno != ENOTSUP)
+- call_arg_warn ("acl_get_file_at", file_name);
++ call_arg_warn ("tar_acl_get_file_at", file_name);
+ return;
+ }
+
hooks/post-receive
--
IPFire 2.x development tree
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2026-07-05 16:08 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-07-05 16:08 [git.ipfire.org] IPFire 2.x development tree branch, next, updated. 6bae1ddacbfad8ed231b8a71b7a7a8acc0519322 Michael Tremer
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox