From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4hHRgR2NK5z2xm3 for ; Sat, 08 Aug 2026 16:44:19 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [IPv6:2001:678:b28::25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4hHRgR1xxrz2xM3 for ; Sat, 08 Aug 2026 16:44:19 +0000 (UTC) Received: from people01.haj.ipfire.org (people01.haj.ipfire.org [172.28.1.161]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bit raw public key) server-digest SHA256 client-signature ECDSA (secp384r1) client-digest SHA384) (Client CN "people01.haj.ipfire.org", Issuer "YE2" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4hHRgG4TGMzBY for ; Sat, 08 Aug 2026 16:44:10 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1786207450; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc; bh=n1nGat9w+F/qu0/803+aQlF/rSK6UUPMq4KbswCJmKU=; b=JTQdNRUDpAXwMoLyq9k6ucrruQnP0UJr3M3SgMtYNbME0lb7pnlWhkdEuvJEQC6uUH+VH3 mNiwNRNR56u+I3DA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1786207450; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc; bh=n1nGat9w+F/qu0/803+aQlF/rSK6UUPMq4KbswCJmKU=; b=kau59Nl8gCDRdbgMT7o2eqlFTOpOSpdPt3yOlL0ROtc118A+ejWHnPeaaUjTWhbmllvy9z pmyUGPJOH/aQ07qStbp1Ab/exIR5FsRm23Dg/0SNw2vS49AjWwaXN3v321Ny0FQFBZ62YK vnH9et3qhYO2nojX9OZHJ+m8KIoh01r0uvTyoHcdJCfiAAXbaVacolCCk6hAp54Ojpmuuq y5phDHKf9PxfjZmr75QVks7C4w/WShHPuhnKh6sYXY8IgLuP4s0y9j5lH5mcivj4eI7Lce zwdpeB/L4PAL5KPsY472J3j1gfhD/OvCAr+D28QZFhjlK5Tky5iuGygzkFAEPA== Received: by people01.haj.ipfire.org (Postfix, from userid 1000) id 4hHRgG2ccbz2xg0; Sat, 08 Aug 2026 16:44:10 +0000 (UTC) To: ipfire-scm@lists.ipfire.org Subject: [git.ipfire.org] IPFire 2.x development tree branch, next, updated. 068360263531050f2727b970fdbb50f3add2c505 X-Git-Refname: refs/heads/next X-Git-Reftype: branch X-Git-Oldrev: eed04bbef5fff399a3acb63030b972b4fb5044aa X-Git-Newrev: 068360263531050f2727b970fdbb50f3add2c505 Message-Id: <4hHRgG2ccbz2xg0@people01.haj.ipfire.org> Date: Sat, 08 Aug 2026 16:44:09 +0000 (UTC) From: Michael Tremer Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 068360263531050f2727b970fdbb50f3add2c505 (commit) via aeafe92d608aa5dfa71620d9243c2433ca6f9e79 (commit) via 8774f333815c0adf2a26d2b67ebe185836f3b1c0 (commit) via 2da301e6a7836875f204c66680d821f66d98684e (commit) via 0dc1965e500bc46915962a300c935ff29757debd (commit) via d692769d94c752225a7cc48b378be8c389939b56 (commit) via e1f5b0c63e6cb6c0c82980d3068612adb5c98ec4 (commit) via 6bfebc4000db303515821b3a6b7ae3873041ec34 (commit) via c3683dff25fa535af812fb91163dfb820048672d (commit) via 8be727e203c726186dd5649d433982d361bc0aa7 (commit) via de065a0192e7969152ea27a1a18290ccdc270fe9 (commit) via 0cbb458549f2924f43c4c1d47f25d92fffc48b65 (commit) via 0f49c2d75a2da499c4ce3430a740fa7b5a857485 (commit) via 809752ad05d48e74fb530df2671bc9e061561a60 (commit) via e8b349a18216085ef8c09e7c4bb1feef0f08dfaf (commit) via 4e6180f5abe6625afadd32748c3bc80cfb06e269 (commit) via 2751eebc46614315a87dc4a3247efd4fdbb0bdb0 (commit) via 5dc07fb29509b6509d91cb8f873ea4c1dd6860d6 (commit) via 3d084985cd6ce8359f760cc920ba545a0c2839de (commit) via 22d60f68d39c1e214511e08a1af980b62cc8222d (commit) via 3f2ad2ac3801c35d2f2a0389092d727092086b5d (commit) via 9d6bbad2f620d3058a16e58de8c1cef75bd410f7 (commit) via b6143f8c1065a54e850c140aad73b1062439ec05 (commit) via 403a7f9c8c6b05c9369568d8f79da9ddb20ba059 (commit) via 9839fb681b1434fd8ac22921984d3474eb07f106 (commit) via 53d845d812ab3f43c3ff5f3705acdced9d001e44 (commit) via 53ff7d74e65c376468e6b03d8792668568c6e997 (commit) via 8de1a761474d750ad638a13bd8db9519f63cabd4 (commit) via 699e136a59202d58714226749d7c8528826a744e (commit) via 025d72134b6d74e99833699728e52f2ea1ace3f7 (commit) via 835758bf4fc3488831cd3db396e69c76a9c5f97d (commit) via 8bc513e1cd04019ca67ff495105b0c2c3ce4ee68 (commit) via cae2012285d39e45e05049d9df7e51c10212e9eb (commit) via 9b09332d370de83d949b1ecaaaa4e6360f5c17c4 (commit) via 9019d363927f58ffddbff64e9e6ce4dfb68331e7 (commit) via 4e71436cf0bef562517b69174ecbeef7d9e30766 (commit) from eed04bbef5fff399a3acb63030b972b4fb5044aa (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 068360263531050f2727b970fdbb50f3add2c505 Author: Michael Tremer Date: Sat Aug 8 16:42:51 2026 +0000 core205: Ship rrdtool Signed-off-by: Michael Tremer commit aeafe92d608aa5dfa71620d9243c2433ca6f9e79 Author: Matthias Fischer Date: Sat Aug 8 17:57:13 2026 +0200 rrdtools: Update to 1.11.0 For details see: https://github.com/oetiker/rrdtool-1.x/releases/tag/v1.11.0 "Bugfixes hardening: size the rrd_diff scratch buffer for its largest input @somethingwithproof rrdtool dump now uses a numeric UTC offset (%z, e.g. +0900) instead of the locale timezone name (%Z) in XML comments. Locale timezone names can be encoded in a non-UTF-8 encoding (e.g. CJK locales), which breaks the XML declaration and causes rrdtool restore to fail with "Input is not proper UTF-8". The numeric offset is always ASCII. Note: existing dump files already containing locale timezone names remain valid XML as long as their encoding matches; newly created dumps will always contain pure ASCII in these comments. Issue #1173 reported by @k79e, fix by @oetiker. Fix segfault when --x-grid is given without a trailing date-format field. The %n conversion in sscanf() is not counted in its return value, so stroff remained uninitialized when the input ended before the final : separator; the subsequent stroff != 0 guard read garbage and could branch into strdup() with a bogus offset. Fixed by initialising stroff = 0 so a partial match safely falls through to the existing "invalid x-grid format" error path. Issue #1291 reported by @anvilvapre, fixed by @oetiker libdbi /derive now returns 0 instead of NaN when the underlying counter is constant (zero delta). Previously the strict d_value > 0 guard skipped zero deltas the same way it skips negative ones (counter resets). Changed to d_value >= 0. Issue #550 reported by @bitionaire, fix by @oetiker. Fix a 1-byte heap buffer overflow in checkUnusedValues() that triggered *** buffer overflow detected *** SIGABRT under glibc fortified strcat() when reporting unused graph arguments. The function under-allocated by one byte and silently relied on that overflow to make its trailing : strip land on the right index. Refactored to size buffers correctly and prepend the separator rather than build-then-strip, so the two no longer have to agree. Reported and original fix attempt in PR #1329 by @ppisar, refactored fix by @oetiker Pad the Perl $RRDs::VERSION / $RRDp::VERSION numeric encoding so two-digit minor releases compare monotonically. The numeric version now uses three-digit zero-padded minor and patch fields, e.g. 1.10.3 -> 1.010003 (previously 1.10003, which was numerically less than 1.9.0 -> 1.9000). The same encoding is now used by NUMVERS in configure.ac and win32/rrd_config.h. Note: consumers that previously tested $RRDs::VERSION >= 1.2 need to update their checks (use >= 1.002 or compare against the X.Y.Z string via the version pragma) -- this is unavoidable given the existing format could not represent two-digit minors monotonically. Issue #1330 reported by @ppisar, fixed by @oetiker Y-axis labels keep enough fractional precision when the gridstep is fractional after SI scaling (e.g. values around 10G+), avoiding duplicate labels on tall graphs. Issue #1326 reported by @muusik, fixed by @oetiker Detect nroff support for -Wbreak at configure time, so building the text documentation works on systems with BSD-derived nroff (e.g. macOS /usr/bin/nroff). Issue #1323 reported by @gigaimage, fixed by @oetiker Fix SIGFPE divide-by-zero crash in rrdtool dump when processing fuzz-crafted RRD files that contain an RRA with pdp_cnt or pdp_step equal to zero. The modulo operation at the heart of the timestamp calculation is now guarded: such files are rejected with a descriptive error message instead of crashing. Issue #783 reported by @rwhitworth, fix by @oetiker. Features rrdgraph: new --vertical-label-angle and --right-axis-label-angle options to rotate the two y axis legends independently at run time. The compile time RRDGRAPH_YLEGEND_ANGLE remains the default for both, so existing graphs are unchanged. Use --right-axis-label-angle 270 to have the right hand legend read from the top down. Suggested by @blappm in #1377, implemented by @oetiker rrdgraph: new --right-axis-range min:max option to suppress right axis labels outside the given range, so a bounded right axis is no longer labelled with values it cannot reach when the left axis range does not line up. Either end may be left empty for unbounded. Suggested by @blappm in #1377, implemented by @oetiker" Signed-off-by: Matthias Fischer Signed-off-by: Michael Tremer commit 8774f333815c0adf2a26d2b67ebe185836f3b1c0 Author: Adolf Belka Date: Sat Aug 8 17:18:06 2026 +0200 tcpdump: Update to version 4.99.6 - Update from version 4.99.5 to 4.99.6 - No change in the rootfile - Changelog Remove protocol decoding for: OTV (draft-hasmit-otv-04, this Internet-Draft is no longer active). Refine protocol decoding for: DNS: Use ND_TCHECK_LEN() instead of a custom bounds check. IPv6: Add a missing comma and remove a colon in the output. TCP: Note if the Urgent Pointer is non-zero while URG flag not set, if the verbose level is > 1 (option -vv and more). TCP: Note if the Acknowledgment Number is non-zero while ACK flag not set, if the verbose level is > 1 (option -vv and more). TCP: Fix Reset segment processing. IP, IPv6: Fix setting the snapshot length for the payload. IP: Use ND_TTEST_LEN() instead of a custom bounds check. frag6: Add a bounds check in non-verbose mode. PTP: Remove spaces before colons in output. PTP: Fix management packet fields. ISO: Avoid undefined behavior and integer overflow in the Fletcher checksum calculation. NFS: Delete dead code. BOOTP: Use an uint16_t variable to get the result of a GET_BE_U_2(). ZEP: use the existing NTP time formatting code. NTP: Fix p_ntp_time_fmt() using epoch 1/epoch 2 convention (RFC 4330). NTP: Update a field name with the RFC 5905 name (Origin Timestamp). IPv6 mobility: Modernize packet parsing and make fixes. IP6OPTS: Modernize packet parsing and make fixes. VXLAN: Add UDP port 8472 used by Linux as the default port. EGP: Replace custom code with tok2str(); Modernize packet parsing and fix printing with -v option. User interface: Add optional unit suffix on -C file size. Improve the handling of size suffixes for -C. Print errors for options -A, -x[x] and -X[X] (mutually exclusive). Print errors about -C, -G and -z options usage. For PCAP_ERROR_CAPTURE_NOTSUP, show the error message provided by libpcap for that error if it's non-empty. Update the -z option processing. Print "invalid option -- z" when it is. Add the -g option, causing IPv4 output in verbose mode to be on one line. Other: Avoid race condition when receiving signal during shutdown. Always show the interface name in error messages when the interface can't be opened. Clean up the message shown if a -i flag is specified with an interface index that's too large. Source code: Fix '-tt' option printing when time > 2106-02-07T06:28:15Z. Add sub-second packet timestamp checks for invalid micro/nano. Remove unused missing/snprintf.c. Fix incompatible pointer types with time functions calls on Windows. Use C99 macros to define 64-bit constants and maximum 64-bit values. Windows: Fixed to find wpcap.dll if WinPcap isn't installed and Npcap was installed without the WinPcap API compatibility option. (GitHub issue #1226). Building and testing: Makefile.in: Use a local libpcap in the releasecheck target. CMake: Fix build with CMake 3.31. autotools, CMake: don't separately test whether snprintf(3) is available and whether it's suitable - the test for whether it's suitable also fails if it's unavailable. CMake: Skip snprintf(3) tests when cross-compiling. autotools, CMake: fix issues with snprintf test and sanitizers. CMake: check whether check_c_source_runs() works, treat the build as a cross-compile if it doesn't work. Autoconf: Use AC_SYS_YEAR2038_RECOMMENDED when possible if the environment variable BUILD_YEAR2038 = yes (via autogen.sh). Autoconf: Avoid incorrectly include the libpcap's config.h. Autoconf: Refine reporting of os-proto.h. Require config.h to be from the tcpdump build. AppVeyor: Update Npcap SDK to 1.15. autogen.sh: Allow to configure Autoconf warnings. autogen.sh: Delete all trailing blank lines at end of configure. Signed-off-by: Adolf Belka Signed-off-by: Michael Tremer commit 2da301e6a7836875f204c66680d821f66d98684e Author: Adolf Belka Date: Sat Aug 8 15:07:05 2026 +0200 haproxy: Update to version 3.4.3 - Update from version 3.4.2 to 3.4.3 - No change in rootfile - Changelog 3.4.3 This release contains one important fix and a handful of security hardening fixes reported by Red Hat/AISLE Research and others, on top of the usual set of bug fixes. * ssl/ocsp: An issue about missing lock was fixed. The OCSP stapling callback read the cached OCSP response buffer without any lock, while the buffer can be freed and replaced at any moment by a "set ssl ocsp-response" CLI command, the ocsp-update task, or a reload. A concurrent update could either crash the worker (use-after-free) or leak freed/reused heap contents to a remote client requesting the stapled response. The reads are now protected by the existing OCSP tree lock. This was reported and fixes by Matt Suiche from Tolmo Inc. * QUIC/H3 : Three bugs were fixed around QUIC/H3 stream shutdown and error handling. A parser desync could occur when an H3 error was detected in the middle of a multi-frame buffer, causing the caller to remove only part of the data and restart parsing at a wrong offset, which usually produced a new, unrelated error or an unwarranted full connection closure. A QCS instance could also be wrongly freed if a STOP_SENDING was still scheduled for it, most impactful on the backend side where a server could keep emitting data on a stream haproxy already considered closed. Finally, shutting down a stream's read side (e.g. an aborted request) did not always send a STOP_SENDING to the peer, so a server backend could keep sending data for a request haproxy no longer cared about. * fd: A deadlock when closing file descriptors of other thread groups was fixed. Destroying a listener while holding the listener lock could deadlock when it needed to close an fd belonging to another thread group and another thread was waiting on the same listener lock. This was easier to reproduce with a suspend/resume loop on ABNS sockets. The fd is now closed using a reference-counting scheme instead of thread isolation, avoiding the deadlock. * tcpcheck: The internal proxy used to parse "healthcheck" sections was not added to the proxies list, so its initialization was not fully finalized; this notably broke some arguments such as regular expressions and could lead to crashes because of a NULL pointer dereference at runtime. * applet: An issue leading to a stale task expiration date was fixed. When an applet was waiting for a connection (e.g. the Lua Socket applet) and reads were re-enabled once the connection became available, this was usually done from the connection's context, so the applet's task expiration date was not refreshed. With small timeouts this could cause the task to appear scheduled in the past, triggering a BUG_ON() in sc_notify(). This was fixed by moving the changes in the applet's context. Related to this issue, a bug about lua cosockets was fixed. the Lua cosocket timeout being applied on the wrong side. It was applied to both the client and server sides, while it must only apply to the server side. * stats: Two issues about the stats page, reported by Red Hat/AISLE Research, were fixed. Proxies updated through the stats page while in "stats admin" mode were not subject to the "stats scope" filtering, meaning a scope meant to restrict which proxies are visible/actionable could be silently bypassed on POST requests. Separately, POST requests to the stats interface did not validate that the Origin (or Referer) header matched the Host, which is now checked to mitigate CSRF attacks. * cache: A leak preventing the cache from reserving rows under "Vary" was fixed. When a secondary cache entry matching a request with a "Vary" header was still incomplete (being written by another stream), the request was forwarded without reattaching its row to the available list, leaking it. Over a Vary-heavy workload this eventually exhausted the cache and prevented any further row reservation. * ssl-gencert: A memory leak on every certificate generation was fixed. Two temporary buffers were not freed after generating a certificate on the fly, leaking memory each time a new SNI triggered certificate generation. This issue was reported by Red Hat/AISLE Research. * sample/protobuf/net-helper: buffer overflows after pointer-shift converters, reported by Red Hat/AISLE Research and Charles Vosburgh, were fixed. Several converters (protobuf/ungrpc field extraction, eth.data, eth.src, ip.data, bytes(), ltrim()) move the sample's data pointer forward on success but did not shrink the sample's recorded buffer capacity accordingly. A converter chained afterwards that relies on that capacity (e.g. padding via memset()) could then write past the end of the buffer, leading to heap corruption or a worker crash. All the affected converters now adjust the capacity together with the pointer. * protobuf: A nested-path validation bypass reported by Red Hat/AISLE Research was fixed. The protobuf field lookup used for the protobuf()/ungrpc() converters did not strictly enforce hierarchical boundaries, so a flat sibling field could incorrectly satisfy a nested-path lookup (e.g. matching a root-level field as if it were nested under a parent). The lookup was rewritten as a strict, non-recursive path walker that correctly bounds each nesting level. Separately, a crash because of deprecated protobuf group wire types was fixed. These wire types are now explicitly rejected. * proxy/server: Some CLI commands dumping info were not protected against concurrent proxy/server/backend deletion. "show servers conn/state", "show backend" and "show errors" all loop over lists of proxies or servers and may yield in case of a large output; if the entry the dump was paused on got deleted (e.g. via dynamic backend/server removal) in the meantime, the worker could crash on restart. These commands now rely on the existing watcher mechanism, already used by "show stat", to survive concurrent deletion. Separately, the check refusing to delete a server still attached to streams was not exhaustive: two paths (a failed connection attempt still referencing the server, and cookie persistence set very early) were not covered by the existing counters, allowing a server to be deleted while still referenced. A new per-thread-group stream counter now tracks this reliably. * ssl: A kTLS splicing regression and a wrongly typo'd macro were fixed. A wrong macro name (USE_VANILLA_OPENSSL instead of HAVE_VANILLA_OPENSSL) could let kTLS start splicing while data was still pending in OpenSSL's internal buffers, causing data not to be properly read. Separately, when kTLS splicing received a non-application-data record (e.g. a TLSv1.3 KeyUpdate), splicing failed outright instead of falling back to a regular recvmsg() long enough to consume the record and resume splicing afterwards. * mux-h1: The case of header names were not being adjusted on some outgoing messages. When a map was configured to adjust the case of some header names for legacy applications, it was not applied to the low-level error messages generated during th request parsing. And for all other messages, "Sec-Websocket-Key" and "Sec-Websocket-Accept" headers, inserted by the H1 multiplexer, were also concerned. * http-fetch: Two crashes reachable from health-check configurations were fixed. "res.body"/"res.hdr"/... and similar response fetches assumed the health-check receive buffer always held an HTX message, which is only true for actual HTTP checks; on a plain TCP check, a hostile/misbehaving server could craft the first bytes of its reply to be misinterpreted as HTX internal fields, causing a wild read and worker crash (or leaking arbitrary process memory). Separately, "capture.req.hdr"/"capture.res.hdr" only validated the upper bound of their index argument, so a negative capture id was accepted at boot and dereferenced an out-of-bounds array entry at runtime, crashing the worker on the very first request. * tools: Converter to encode URLs was fixed to avoid silent truncation. encode_chunk(), used among others by the url_enc converter and OCSP encoding, used to silently truncate its output when the destination was too small, which could produce a partially-encoded URL. It can now fail explicitly instead; the url_enc converter and OCSP code were updated accordingly. * slz: Several issues were fixed in the SLZ library. A stream alternating many literals in the 144-255 range with cheap back-references could keep inflating indefinitely instead of falling back to a stored block, exceeding the library's documented worst-case output size by several percent. A new accounting mechanism now bounds this overhead. Practical impact on haproxy requires tune.bufsize above ~43 kB with the default reserve. Five small correctness fixes inherited from upstream libslz were also backported: Avoid reading up to a few bytes past the end of very short inputs on architectures without fast unaligned access; stop appending an extra, misplaced block to an already-finished deflate/gzip/zlib stream (which could corrupt the trailing checksum in ~2% of fuzzed streams); fix the Adler32 checksum accumulator sign handling on 32-bit systems (affecting the zlib format only); avoid an undefined-behaviour signed left shift when assembling input words byte by byte; and use the exact bit cost when deciding whether to emit the last literals of a block as a stored block, avoiding compressed output slightly larger than the documented worst case. * peers: A heap overflow when replicating large stick-table dictionary entries was fixed. peer_prepare_updatemsg() never verified that a stick-table entry's dictionary value (e.g. server_key, up to ~16 kB) actually fit in the update message being built. Since the peers protocol is plain-text and unauthenticated, a rogue or compromised peer could plant an oversized entry that overflows the 16 kB trash buffer as soon as the victim replicates ("teaches") it, confirmed as a heap-buffer-overflow write. The function now checks the available room before encoding and fails clea nly if it doesn't fit. This was reported and fixes by Matt Suiche from Tolmo Inc. * chunk: The code was reviewed to avoid retrieving a large trash buffer by mistake. All call sites of the trash-chunk allocation helpers were reviewed to make sure a large buffer is only handed out when the caller's own buffer is already large and genuinely needs it, preventing unexpected extra memory usage. Several call sites were switched to the new get_best_trash_chunk()/alloc_best_trash_chunk() helpers. * resolvers: Possible conflicts between the internal backend used for the "default" resolvers sections and regular backends with the same name were fixed. Since a "default" resolvers section is now created automatically, a same-named internal TCP backend proxy also appeared, and a config using "default_backend default" could either fail with a confusing "mode" error or silently route real traffic to the internal resolvers backend. Resolvers no longer need to be looked up by name in the proxies index, so they are no longer indexed there. Fixes GitHub issue #3445. * server-template: Duplicated entries created from a "server-template" line did not properly inherit several settings that are only initialized once for the base line by srv_settings_init(). The field, used to select an alternative protocol such as MPTCP, was not copied to server-template duplicates, resulting in the wrong protocol being selected on connect. The "check-reuse-pool" flag, forcefully enabled for rHTTP servers, was not propagated either, causing health checks to always fail on rHTTP server-template entries. And the QUIC transport was never set up for these duplicates at all, since it was only performed in _srv_parse_init(), preventing any QUIC communication on server-template entries with a quic4/6 address. All three settings are now properly duplicated/initialized in srv_settings_cpy(), or moved to a callback that also runs for duplicates. A related improvement makes parsing error messages usable for server-template lines, which used to show "server-template be/(null)" instead of the template's name. * cebtree: A bug in the duplicate-key detection of the lookup shortcut was fixed. It could make a lookup return the wrong entry among a list of duplicates, or make the walk to the previous/next duplicate fail to find it, as soon as the tree was deep enough to enter the shortcut path. This affects the cebis_tree used since 3.3 to index server names (conf.name), where it could sometimes let a duplicate server name go undetected. And, as usual, the bunch of minor fixes here and there, mainly raised during AI-assisted code reviews. Most were never noticed: * HTX API: Some bugs about how the HTX API was used were fixed here and there. * http-act: Double-frees and a couple of state bugs on parsing errors were fixed. * http-fetch/http/http-ana/http-htx: Few out-of-bounds reads and a missing NULL/allocation check were fixed. * h1: The right error offset is now reported for an authority/Host mismatch when "accept-unsafe-violations-in-http-request" option is enabled * http-conv: The last input character could be lost when calling url-dec converter, when the input buffer was full. This was fixed by failing the converter in that case. * http-rules: A crash on error path when parsing "set-cookie-fmt" redirect rule was fixed. * mux-h1: An extra 200ms delay was observed on some H2-to-H1 messages because the end of the message was not always properly detected. This case is now properly handled. * sample: Two edge cases in be2hex() and bytes() were fixed. * shctx: An issue in the shctx was fixed. This notably broke revalidation of cached responses whose ETag was stored beyond the first block, causing a full 200 response to be served instead of a 304. * ssl: "show ssl sni -f " command was silently falling back to the first proxy when the given frontend did not exist. An error is now reported. * stream: Custom per-request timeouts/retries set on listeners via "set-timeout" and "set-retries" action are now preserved, except when the stream is routed to a diffent backend. The configuration manual was updated to document this case. Otherwise, two changes were backported: * htx: To avoid trouble with large buffers, it is no longer possible to handle HTTP headers exceeding the size of a regular buffer. It is mandatory to avoid interoperability issues with H2 and H3. * ssl: tune.ssl.keyupdate-rate-limit global directive was added to mitigate costly TLSv1.3 KeyUpdate floods. Processing a TLSv1.3 KeyUpdate is CPU-expensive and there is normally little reason to receive many of them. This new tunable caps the number of KeyUpdates accepted per second (default 100, 0 disables the limit). Signed-off-by: Adolf Belka Signed-off-by: Michael Tremer commit 0dc1965e500bc46915962a300c935ff29757debd Author: Adolf Belka Date: Sat Aug 8 15:07:04 2026 +0200 frr: Update to version 10.7.0 - Update from version 10.6.0 to 10.7.0 - Update of rootfile - Changelog 10.7.0 New Features Highlight BFD authentication with keychain support BFD sessions can now use the FRR keychain framework for authentication. Supported algorithms include cleartext, SHA-1, and the meticulous variant required by operators running strict authentication policies. Keychains integrate with BFD profiles and northbound configuration for single-hop, multi-hop, and SBFD sessions. BGP-LS SRv6 extensions BGP Link-State now advertises and processes SRv6 topology information, including: SRv6 Capabilities TLV SRv6 Locator TLV SRv6 SID NLRI (including End, End.X, and LAN End.X forms) SRv6 Endpoint Behavior TLV SRv6 SID Structure TLV Static SRv6 SIDs configured in zebra can be exported into BGP-LS, enabling SRv6-aware TE controllers to consume locator and SID information from FRR. BGP route-map based allowas-in allowas-in can be applied selectively through route-maps instead of only as a blanket peer or address-family knob. This allows finer control over which received routes may contain the local AS in the AS_PATH, improving policy flexibility in complex multihomed and hub-and-spoke designs. OSPFv2 RFC 4222 control-plane DSCP marking OSPFv2 can classify control packets into high- and low-priority queues per RFC 4222 recommendation 1. Recommendation 2 extends the neighbor inactivity timer behavior for low-priority control traffic. Operators can mark OSPF control traffic with DSCP values to protect routing protocol stability under congestion. OSPF BFD quick neighbor When BFD is enabled on OSPF interfaces, a quick-neighbor mode reduces the time needed to bring up OSPF adjacencies over BFD-monitored links. This is useful on fabrics where fast reconvergence after link-up is required. PIM IGMP proxy route-map filtering IGMP proxy joins and prunes can be filtered with ip igmp proxy route-map. A new route-map match condition, match multicast-source-interface, allows policy based on the interface where a join was learned. This helps deployments that proxy IGMP between access and core segments while restricting which groups or sources are forwarded. PIM dense-mode Assert on multi-access LAN Dense-mode wrong-interface traffic on shared LANs now runs the RFC 3973 Assert procedure instead of immediately pruning all neighbors. On point-to-point links the previous immediate-prune behavior is preserved. This elects a single forwarder on multi-access segments and avoids pruning active branches when duplicate (S,G) packets arrive on a non-RPF interface. PIM Auto-RP allow-rp support A new allow-rp configuration accepts Auto-RP groups even when the embedded RP address does not match the local RP configuration. IPv4 and IPv6 Auto-RP are supported through northbound/YANG modeling. This helps mixed-vendor or transitional Auto-RP deployments where strict RP identity checking would otherwise drop valid control traffic. Static route per-route metric and nexthop ECMP weight Static routes now support a per-route metric as a non-key attribute, independent of the existing administrative-distance key. Static ECMP nexthops can carry weights for unequal-cost multi-path forwarding. Together these align static routing policy more closely with zebra’s nexthop-group handling used by other protocols. What's Changed EVPN RMAC management fixes and test coverage by @soumyar-roy in #20588 ospfd: Display message when clearing interface without OSPF by @soumyar-roy in #20267 zebra: FRR restart leads to zebra mlag core by @soumyar-roy in #20225 zebra: limit RTADV socket rcvbuf to 20MB by @hengwu0 in #20654 Evpn test abstraction by @donaldsharp in #20637 pimd,pim6d: fix last-member-query-count and add robustness value by @rzalamena in #20613 bgpd: Changes to include new fields in "show bgp router" command by @soumyar-roy in #20631 bgpd: Fix double-free crash in peer_delete() during doppelganger peer… by @routingrocks in #20661 staticd: Fix SRv6 SID use-after-free on locator deletion by @cscarpitta in #20660 yang: Correct pyang errors in frr-nexthop.yang by @y-bharath14 in #20694 bgpd: Replace 3 with BGP_ALLOWAS_IN_DEFAULT constant by @ton31337 in #20698 Fixes for op-state change notifications being sent to backend clients (daemons) by @choppsv1 in #20647 bgpd: Missing large community value in commAttriSentToNbr JSON by @soumyar-roy in #20608 lib,bgpd: Adding JSON str for time in dd:hh:mm:ss format by @soumyar-roy in #20632 bgpd: use BGP_PATH_INFO_NUM_LABELS macro in bgp_evpn_path_info_get_l3vni by @nick-bouliane in #20679 Add new show command to display only failed routes by @deepak-singhal0408 in #20343 bfdd: early return on socket allocation failure by @ethanmilon-6wind in #20700 zebra: add state column to 'show evpn es' command output by @shashanka-ks in #20711 zebra: add 'no encapsulation' command under segment-routing/srv6 by @hedrok in #20716 tests: Check PIM Register/-Stop handling in pim_igmp_vrf topotest by @gromit1811 in #18329 ospf6d: Fix stack buffer overflow in link LSA by @rminnikanti in #20695 bgpd: fix md5 password unset on dynamic nbr by @chiragshah6 in #20740 bgpd,zebra: EVPNv6 addressing coverity warnings by @Manpreet-k0 in #20680 bgpd: Fix suppress-fib-pending config race condition on startup by @krishna-samy in #20622 bgpd: fix batch clearing resume to use correct lookup APIs by @miteshkanjariya in #20738 bgpd: add a counter for received duplicate updates by @enkechen-panw in #20553 bgpd: Fix AS path exclude not working during VRF route re-import by @soumyar-roy in #20556 Nexthop weight support for static routes (ECMP/UCMP) by @iurmanj6WIND in #20559 Add memberCount into peer-grp json AND GR fields in fields in show bgp vrfs json by @raja-rajasekar in #20578 zebra: uninstall remote neigh even when ifp is down by @raja-rajasekar in #20587 vtysh: Add JSON output support for show memory by @ton31337 in #20605 bgpd: Ignore transitiveness flag when checking type for link bandwidth by @ton31337 in #20607 bgpd: Show all advertised paths including non-best paths only if addpath is enabled by @ton31337 in #20618 bgpd: implement new redistribute json command by @soumyar-roy in #20630 ospf6d: Fix FULL adjacency persisting despite MTU mismatch by @rminnikanti in #20681 doc: Fix VRF-related and PIM docs by @gromit1811 in #20717 zebra: rename BondState to State in 'show evpn es' output by @shashanka-ks in #20721 lib: use MTYPEs for northbound in several places by @mjstapp in #20733 Non route replace semantics by @donaldsharp in #20725 yang: Fix pyang errors in frr-bgp-filter.yang by @y-bharath14 in #20746 zebra: shorten label for RNH mem type by @mjstapp in #20749 *: Fixed coverity warnings in multiple areas by @Manpreet-k0 in #20610 bgpd: EVPN MH fix unimport ES route on vtep change by @Manpreet-k0 in #20730 Zebra fixup nhg handling from kernel by @donaldsharp in #20732 zebra: Updation of ifp->flags by @hnattamaisub in #20769 fix spell checks round 4 by @chiragshah6 in #20771 tests: Deleted duplicate imported modules by @y-bharath14 in #20779 Sharp send tableid for route by @donaldsharp in #20634 bgpd: unref routes when yielding during clearing iteration by @mjstapp in #20789 bgpd: fix premature deletion of already-stale routes during GR clearing by @miteshkanjariya in #20768 bgpd: validate incoming NOTIFICATION messages by @mjstapp in #20796 tests: Add a default route test to rip by @donaldsharp in #20799 yang: Fix pyang errors in frr-bgp-types.yang by @y-bharath14 in #20797 Multiple local fix by @donaldsharp in #20798 bgpd: improve flowspec NLRI validation by @mjstapp in #20814 bgpd: Reorder some struct attr members by @ton31337 in #20822 tests: Add additional wait tim to test_bgp_gr_functionality_topo2-3.py by @donaldsharp in #20788 Separate sg rpt sg ifchannels and add ability to set a override-interval and a test. by @donaldsharp in #20552 zebra: EVPN fix access BD deref of mbr intf by @chiragshah6 in #20791 tests: EVPN add dynamic nbr with ext router by @chiragshah6 in #20737 zebra: Allow redistribution events to pass reserved ranges by @donaldsharp in #20599 Fix ospf checksum #20706 by @Ko496-glitch in #20729 Kernel skip some route updates by @donaldsharp in #20666 bgpd: Force sending conditional updates by ignoring MRAI timer by @ton31337 in #20668 tests: Don't try to use identical rmacs in rare situation by @donaldsharp in #20844 tests: Fix rip_default_route_handling to be more consistent by @donaldsharp in #20838 pimd,ospfd: Passing local source address as part of BFD session creation by @usrivastava-nvidia in #20739 tests: Remove SRv6 SID check duplication by @cscarpitta in #20843 babeld: fix NULL pointer dereference in babel_clean_routing_process by @LyZephyr in #20727 vtysh: add additional options to ping command by @kaffarell in #20283 ospfd: prefer existing default route over generating by @rzalamena in #20699 tests: Do not fail zebra_nhg_check if skipped is not 0 on initial by @donaldsharp in #20855 Bgp peer sendq timing by @donaldsharp in #20839 tests: Unnecessary pass statement in test_bgp_lu.py by @y-bharath14 in #20860 Add info_count to route_table for accurate RIB entry reporting by @mike-dubrovsky in #20206 various spell check round 5 by @chiragshah6 in #20866 staticd: in route config, reject keywords as ifname by @mjstapp in #20311 debian: prefer libyang3 over libyang2 when building deb packages by @Jafaral in #20871 yang: Revision statements are not given in reverse chronological order by @y-bharath14 in #20870 tools: Add ldp commands to support bundle generation by @donaldsharp in #20863 lib: minor RCU/atomics improvements by @eqvinox in #20864 ldpd: Reuse port for ldpd sockets that set local ports by @donaldsharp in #20858 tests: Fix grpc-query.py to find micronet by @donaldsharp in #20880 pimd: When address change ensure DR changes too. by @donaldsharp in #20881 A few small Coverity fixes by @mbaldessari in #20888 lib/typesafe: guard skiplist level generation against ctz(0) UB by @florath in #20899 ospf6d: recalculate AS-external routes on non-external RIB updates by @donaldsharp in #20882 tests: fix some python and test syntax by @mjstapp in #20905 Always compare med fix by @donaldsharp in #20909 bgpd: fix memory leak in cluster_intern() by @enkechen-panw in #20913 bgpd: clear several parameters in subgroup_announce_check() by @enkechen-panw in #20884 isisd: fix memory-related issues and RFC-violations by @SpadeMomo in #20333 lib, bgpd: add "unique mode" for route tables, supporting direct lookup only by @mjstapp in #20589 bfdd: BFD Admin-Down State Management Improvements by @sougatahitcs in #20151 zebra: add 'show evpn es-peer' command for EVPN-MH peer VTEP list by @shashanka-ks in #20868 tests: Allow for different bestpaths to be generated. by @donaldsharp in #20889 yang: Revision statements are not given in reverse chronological order at frr-staticd.yang by @y-bharath14 in #20921 bgpd: fix the local-preference setting for EBGP-OAD by @enkechen-panw in #20898 zebra: Modify rib_process_dplane_results to limmit work done by @donaldsharp in #20902 doc: add some text regarding libyang versions by @choppsv1 in #20862 bgpd: correct the display header by @anlancs in #20927 bgpd: commits for the listening port by @anlancs in #20929 bgpd: Support for new "show bgp bestpath [json]" show command by @soumyar-roy in #20616 Zebra neighbor changes by @donaldsharp in #20912 Add support for libyang5 by @choppsv1 in #20895 eigrpd: handle the gr neighbor list safely in update_receive by @mjstapp in #20933 nhrpd: fix packet and buffer handling errors by @mjstapp in #20932 tests: fix a regex in all_protos topotest by @mjstapp in #20911 lib, tests: add a srcdest get_next api by @mjstapp in #20906 zebra: bump dplane minor version for 10.7 by @mjstapp in #20943 doc: add multicast testing guide for topotests by @Jafaral in #20945 lib: display End.DX2 route with appropriate oif attribute by @pguibert6WIND in #20954 bgpd: Fix test for OPEN message with remote-as auto by @ton31337 in #20963 bgpd: Add missing PEER_FLAG_SEND_NHC_ATTRIBUTE for update group flags by @ton31337 in #20956 bgpd: Reuse prep_for_rmap_apply() before route_map_apply() by @ton31337 in #20957 pimd: fix msdp mesh group SA crash by @lpchambers in #20900 isisd: Fix remaining buffer size calculation in lsp_bits2string by @rbgarga in #20984 vrrpd: Notification from zebra is not sent to vrrp by @hnattamaisub in #20270 bgpd: make code more robust in bgp_advertise_attr_unintern() by @enkechen-panw in #20989 babeld: fix RFC violations in babel message parser by @SpadeMomo in #20339 pathd: add 'no traffic-eng' command, add test, don't output 'segment-routing/traffic-eng' in configuration always by @hedrok in #20638 bgpd: Fix condition when evaluating paths by @ton31337 in #20975 bgpd: Fix routes to be removed from rib when suppress fib pending is configed by @nishant111 in #20917 bgpd, isisd, ospfd: coverity fixes by @ashred-lnx in #20948 bgpd: Fix nht to properly notice a change by @donaldsharp in #20986 Zebra MetaQ and dplane provider fixes by @donaldsharp in #20944 bgpd: Fix EVPN-MH route cleanup race condition during interfaces flap by @krishna-samy in #20710 pcep: fix heap buffer overflow by @iurmanj6WIND in #20994 tests: bgp_nhc add test to expose NHC update race on peer changes by @donaldsharp in #20949 bgpd: update on l2attr ecommunity by @lsang6WIND in #20980 ospfd: harden TE/SR TLV iteration against malformed lengths by @Jafaral in #21002 GitHub ci improvements by @Jafaral in #21003 bfdd: Fix wrong memory free when using ttable code by @donaldsharp in #21020 More Neighbor Fixes by @donaldsharp in #20934 yang: Correct pyang errors in frr-pim-candidate.yang by @y-bharath14 in #21030 zebra: fix stale remote vtep entries by @Manpreet-k0 in #20977 Bfd QoL improvements by @donaldsharp in #21004 ospf6d: clear local ifp per ECMP path rebuild by @florath in #21037 lib: add rbtree pop_final api by @mjstapp in #21034 doc: bgp: add entry for neighbor PEER soft-reconfiguration inbound by @kaffarell in #21009 Fix docker (Alpine) compilation by @ton31337 in #21042 tests: Fix wrong filename and description in test_srv6_locator.py by @cscarpitta in #21044 bgpd: Fix SRv6 SID/locator memory leak in SID notify handler by @cscarpitta in #21049 zebra: Add no prefix command for SRv6 locators by @cscarpitta in #21048 Some Yang work by @donaldsharp in #21027 bgpd: fix off-by-one error in FlowSpec operator array bounds check by @Jafaral in #21054 bgpd: Support brief option for show bgp neighbors command by @hnattamaisub in #20914 Docs: Document import vrf route-map NAME, several EVPN improvements by @robinchrist in #20714 bgpd: avoid premature memory allocation in subgroup_announce_check() by @enkechen-panw in #21005 bgpd: Add support for BGP-LS (RFC 9552) by @cscarpitta in #20470 bgpd: Fix BGP best path reasoning when using ECMPs with router-id by @ton31337 in #21052 tests: Convert lots of places to use run_and_expect by @donaldsharp in #20893 *: fix spell checks round 6 by @chiragshah6 in #21057 yang: Fix pyang errors in frr-ospf6-route-map.yang by @y-bharath14 in #20991 lib: fix zclient crash when many peers reconnect after FRR restart by @nick-bouliane in #21056 zebra: Remove neighbor table read on rule addition by @donaldsharp in #21053 bgpd: Fix integer truncation of SRLG count when parsing SRLG TLV by @cscarpitta in #21077 bgpd: Check if the NHC length is enough to fill TLV value + TLV header by @ton31337 in #21074 lib: fix vty_is_closed() falsely reporting VTY_SHELL as closed by @Manpreet-k0 in #21082 lib: use const in vty-is-shell apis by @mjstapp in #21094 bgpd: Fix integer truncation of count when parsing Route Tag TLV by @cscarpitta in #21078 ospfd: fix sequence number check, avoid truncation ambiguity by @Jafaral in #21096 bgpd: Fix late reverse-edge destination linkage in BGP-LS code by @cscarpitta in #21109 nhrpd: Correct addrlen check in os_recvmsg() by @csiltala in #21100 ldpd: improve tlv validation in several places by @mjstapp in #21118 PIM message-handling code fixes by @donaldsharp in #21093 bgpd: Fix issues in BGP-LS node/link/prefix origination by @cscarpitta in #21108 bgpd: fix errors in several paths by @mjstapp in #21101 bgpd: fix I/O thread spinning when peer input queue is full by @kzhang-amzn in #21028 tests: Ensure upstream IIF is in correct state after interface events by @donaldsharp in #21114 lib: fix crash in thread_process_io_inner_loop on stale epoll event by @Manpreet-k0 in #21124 tests: Slow down test_config.py to allow for processing time to happen by @donaldsharp in #21127 isisd: fix edge condition in max_lsp_count computation by @mjstapp in #21159 bgpd: Return 0 if AS4 capability is malformed by @ton31337 in #21112 bgpd: Prevent heap use-after-free for tunnel encapsulation attribute by @ton31337 in #21176 CI: fix node js deprecation warning, limit mergify backports github ci runs by @Jafaral in #21175 tests: fix grpc_basic xdist collection mismatch by @Jafaral in #21158 bfdd: harden packet validation and reflector handling by @Jafaral in #21105 isisd: fix memory leak in remove_excess_adjs() by @quentinbaradat in #21183 bgpd: include length in cluster_hash_cmp() by @enkechen-panw in #20988 bgpd: add config "nexthop prefer-global" for ipv6 address family by @enkechen-panw in #21099 isisd: Fix missing neighbor address Sub-TLVs after link-params change by @cscarpitta in #21204 bgpd: Free hostname for FQDN capability if the parsing goes wrong by @ton31337 in #21043 bgpd: Do not process route-refresh for AFI/SAFI if it's not negotiated by @ton31337 in #21210 bgpd: fix NHT for explicit link-local BGP peers by @soumyar-roy in #21188 zebra: fix missing vlan change by @anlancs in #20350 bgpd: Validate MP_REACH_NLRI attribute against incorrect next-hop by @ton31337 in #21075 bgpd: harden attribute parsing and packet handling in a few places by @ton31337 in #21095 nhrpd: harden against malformed packets by @Jafaral in #21097 bgpd: Return original as-path when reconciling AS versus AS4 by @ton31337 in #21113 tests: add EVPN VTEP cleanup and recovery test on uplink flap by @Manpreet-k0 in #21126 bgpd: improve packet parsing for EVPN and ENCAP/VNC by @mjstapp in #21098 bgpd: fix BGP_ATTR_NEXT_HOP flag handling in bgp_attr_default_set() by @enkechen-panw in #21166 [WIP] nhrpd: guard AFI/table lookups in route resolution by @Jafaral in #21187 bgpd: Fix route-map cleanup ordering in SRv6 unicast SID export by @cscarpitta in #21191 tests: bgp_suppress_duplicates: simplify and split into four tests by @enkechen-panw in #21203 ripd: fix data-handling in several places by @mjstapp in #21215 ripd: fix ip rip send/receive version command by @Shbinging in #18217 bgpd: Fix coverity defects in BGP-LS code by @cscarpitta in #21102 ripngd: fix data handling in several places by @mjstapp in #21217 bfdd: moving bfd socket allocation from static to dynamic by @sougatahitcs in #20854 bgpd: Check if we are not overusing error_data buffer when unknown cap received by @ton31337 in #21211 bgpd: backpressure generic framework by @chiragshah6 in #21192 vrrrpd: improve error handling in several paths by @mjstapp in #21251 bgpd: fix BNC cleanup for explicit link-local peers by @soumyar-roy in #21264 zebra: add debug in route install around nhg not ready by @chiragshah6 in #21265 zebra: Move allow-external-route-update to mgmt frontend side by @donaldsharp in #21276 Enable RFC8342 YANG NMDA functionality and add router-id oper-state that uses it. by @choppsv1 in #21065 zebra: lib: use old compatible value for lyd_new_term by @choppsv1 in #21281 bgpd: BGP-LS: add Prefix SID (TLV 1158) by @hedrok in #21076 tests: Fix wrong expectations in bgp_srv6_unicast topotest by @cscarpitta in #21284 bgpd: Fix SRv6 SID export route-map update not taking effect by @cscarpitta in #21283 bgpd: Fix incorrect comparisons in BGP-LS *_cmp() functions by @cscarpitta in #21285 pimd: In sparse-dense mode, treat a group as sparse if an RP is configured by @Jafaral in #21216 tests: Give more time for interface information to show up by @donaldsharp in #21278 bgpd: call init, term, copy LS attr admin_group by @mjstapp in #21289 zebra: fix spurious tag mismatch in rib_route_match_ctx() by @enkechen-panw in #21293 bgpd: add brief JSON for ipv4/ipv6 unicast loc-rib by @hnattamaisub in #21050 bgpd: brief JSON for L2VPN EVPN loc-rib by @hnattamaisub in #21019 ospfd, ospf6d: do not install routes for directly attached networks by @rzalamena in #20720 bgpd: Add SRv6 uDT46 SID support for GRT by @cscarpitta in #21041 Move import table around by @donaldsharp in #21068 bgpd: Fix a couple of issues in BGP-LS NLRI encoding/decoding by @cscarpitta in #21092 pceplib, pathd: improve pcep parsing and error-handling by @mjstapp in #21208 lib: fix swapped values, bad setsockopt, and intermittent test failure by @choppsv1 in #21214 bgpd: fix suppress-fib-pending blocking EVPN GR by @Manpreet-k0 in #21231 lib: also compare rmap source address when comparing nexthop source a… by @ak503 in #21233 bgpd: Fix BGP-LS initial TED sync and cleanup on peer deactivation by @cscarpitta in #21286 doc: Update json handling specification in workflow.rst by @donaldsharp in #21244 bgpd: flowspec foobar hardening by @ton31337 in #21308 Soumya/pim allowrp by @soumyar-roy in #20326 pceplib: validate during of_list TLV decoding by @mjstapp in #21310 bgpd: Revalidate locally originated routes against RPKI changes by @ton31337 in #21302 ospf6d: improve/harden packet processing by @mjstapp in #21277 Rpki fix and test improvements by @donaldsharp in #21315 pimd: fix crash due to double free by @Jafaral in #21354 eigrpd: improve validation and error-handling in tlv parsing by @mjstapp in #21316 bgpd: Verify if we correctly parsed BGP-LS attribute by @ton31337 in #21344 bgpd: More validations for labeled unicast and ENCAP attribute by @ton31337 in #21343 bgpd: Reset the stream to attr_start + attribute_len when WITHDRAWN by @ton31337 in #21351 ci: Adjust github workflows (actions) by @ton31337 in #21353 doc: document common daemon options and link -w references by @kaffarell in #21342 bgpd: A couple fixes for NLRI label parsing and flowspec decoding overflow by @ton31337 in #21340 doc: fix indentation error in pim doc by @mjstapp in #21373 bgpd: fix "use-after-free" for updgrp by @anlancs in #21081 bgpd: remove dest list from batch-clearing code by @mjstapp in #21382 bgpd: EVPN json brief optimization by @hnattamaisub in #21352 bgpd: Fix srv6 type parsing and EVPN type-5 NLRI prefix lengh parsing for IPv4 by @ton31337 in #21345 bgpd: Check if Local-Node and Remote-Node TLVs length is within boundaries by @ton31337 in #21349 bgpd: add additional attributes for evpn detail/ipv4/ipv6 detail json by @hnattamaisub in #21035 bgpd: display aggregate->count in show bgp detail for aggregate route by @enkechen-panw in #21309 isisd: improve validation of flex-algo decoder by @mjstapp in #21314 bgpd: Return an error for unknown flowspec component type by @ton31337 in #21350 bgpd: Modify early route processing to include send to zebra by @donaldsharp in #21357 pceplib: add validation to PCEP PST TLV decode by @mjstapp in #21372 bgpd: Fix memory leak for nhc attribute if ipv6 is link-local address by @ton31337 in #21377 tests: Fix time re in all_protocol_startup/test_all_protocol_startup by @hedrok in #21378 doc: fix BGP interface neighbor IPv4, IPv6, and v6only documentation by @nick-bouliane in #21383 zebra: EVPN prevent stale mbr_zifs entries from early return by @chiragshah6 in #21391 staticd: fix static_disable_vrf() to always send a route DELETE by @enkechen-panw in #21392 bgpd: Do not allocate stream if route-refresh capability is not received by @ton31337 in #21394 bgpd: Check dynamic capability action before validating ENHE capability by @ton31337 in #21395 bgpd: fix wrong overwritten for evpn by @anlancs in #21398 bgpd: Do not allow triggering route-refresh path with a malformed ORF length by @ton31337 in #21399 tools: Upgrade configuration to current format for Mergify by @ton31337 in #21409 topotests: split bgp_evpn_mh_v4_v6_num v4/v6 layout by @ashred-lnx in #21389 doc: fix SRv6 route commands by @iurmanj6WIND in #21416 pimd: guard channel OIL detach against stale pointers by @Jafaral in #21431 yang: Correct pyang errors in frr-pim-route-map.yang by @y-bharath14 in #21433 doc: fix SRv6 route commands (bis) by @iurmanj6WIND in #21432 bgpd: Fix copy-paste error in SRv6 DT46 SID duplicate install check (CID 1670455) by @cscarpitta in #21443 bgpd,lib,zebra: use explicit casts in tracepoint definitions by @mjstapp in #21438 bgpd: Skip oversized BGP-LS Node and Link Name TLVs by @cscarpitta in #21455 pimd: pim_inet4_dump -> %pI4s by @eqvinox in #21458 bgpd: Use %pI4/%pI6 formatters in BGP-LS NLRI display by @cscarpitta in #21456 bgpd: Fix wrong union member access in bgp_ls_nlri_display() by @cscarpitta in #21453 bgpd: Allow overriding "remote-as" per-neighbor by @ton31337 in #21450 zebra: remove kernel route on last address deletion by @hedrok in #19564 bfdd: avoid prefix-list memory allocation in bfd to solve oom issue by @sougatahitcs in #21073 watchfrr,tools: add --collect-core to core dump unresponsive daemon by @nishant111 in #21051 bgpd: remove unreachable json_paths free in evpn_show_all_routes() by @Jafaral in #21461 bfdd: bfd tx timeout topotest cleanup by @sougatahitcs in #21026 ripd,yang: log neighbor events by @rzalamena in #21442 ci: gate github-ci Build/Test jobs on non-doc paths; add HTML doc job by @Jafaral in #21475 Mgmt frontend problems in zebra by @donaldsharp in #21252 ospf6d: Remove ospf6 route when connected wins by @donaldsharp in #21476 pceplib: obj is already de-refed, no need to check for NULL by @donaldsharp in #21462 zebra: support brief json for show ip route command by @hnattamaisub in #20950 mgmtd: align commit config request argument order by @Babaijan in #21483 pceplib: ignore NULL obj in free_obj api by @mjstapp in #21487 staticd: fix static_cleanup_vrf() nexthop-VRF removal ordering by @enkechen-panw in #21413 bgpd: fix last Reset timer losing day part after 24 hours by @soumyar-roy in #21489 ospfd: add validation in several places before accessing message bodies by @mjstapp in #21303 pimd: fix NOCACHE MFC resync detection log, add vrf name too by @Jafaral in #21481 doc: refresh README with project links, badges, and contributor notes by @Jafaral in #21499 bgpd: Avoid unnecessary code path for brief command flow by @hnattamaisub in #21412 fix unnecessary BGP peer re-establishment in confederation by @wangdan1323 in #21439 Watchfrr phased restart by @donaldsharp in #21460 lib: mgmt: expose short-circuit bool as is_mgmtd by @choppsv1 in #21508 bgpd: Support established and failed options for show bgp neighbor co… by @hnattamaisub in #21066 zebra: add numMacs and numArpNd to L3 VNI detail output by @sougatahitcs in #21263 pimd: improve logging in a few places by @Jafaral in #21356 tests: clean up a build warning in a unit-test by @mjstapp in #21509 zebra: convert EVPN neigh hashes to typesafe (+.h cleanups) by @eqvinox in #21388 tests: Use abs_srcdir for tests. by @jkroonza in #21390 bgpd: add configurable advertisement delay for suppress-fib-pending by @deepak-singhal0408 in #21384 zebra: fix wrong hash count function call by @rzalamena in #21512 bgpd: Fix mixed remote-as for peer-groups when using auto by @ton31337 in #21406 bgpd: Don't mark nexthop as changed if a set next-hop unchanged is applied by @ton31337 in #21445 tests: update .gitignore for isis test by @mjstapp in #21530 tests: Check if IPv6 MTU change is triggering BGP updates correctly by @ton31337 in #21500 bgpd: PMSI tunnel attribute compatibility by @mjstapp in #21507 ospfd: add LSA validation in the apiserver path by @mjstapp in #21536 eigrpd: reject invalid prefix mask len by @mjstapp in #21539 eigrpd: enforce minimum TLV length in Hello handler by @TristanInSec in #21543 isisd: use correct min size values for srv6 subtlvs by @mjstapp in #21540 bgp_evpn: fix memleak when configuring rd by @lsang6WIND in #21566 bgpd: fix neighbor IP comparison for IPv6 memcmp return values by @hnattamaisub in #21559 bgpd: Replace the actual local-as when using replace-as with the confederation by @ton31337 in #21551 lib: northbound: distinguish unknown schema node from key mismatch by @reinaldosaraiva in #21534 bfdd: Move bfdproflist declaration to header by @pguibert6WIND in #21518 ospfd,tests: fix OSPF connected overlapping prefix bug by @rzalamena in #21510 bgpd: Print neighbor link type correctly according to local-as by @ton31337 in #21486 ospf6d: update auth sequence number after validating digest by @mjstapp in #21588 isisd: Preserve flags when copying SRv6 End SID sub-TLV by @cscarpitta in #21584 eigrpd: fix byte order in Hello authentication decode by @TristanInSec in #21545 lib: Report IPv6 MTU and not IPv4 for if_update_state_mtu6 by @ton31337 in #21501 bgpd: Prevent out-of-bound reading handling soft version dynamic capability by @ton31337 in #21602 bgpd: fix valgrind memory leaks on daemon shutdown by @soumyar-roy in #21511 isisd: continue hardening SRV6 tlv parsing by @mjstapp in #21585 Add new BGP SRv6L3VPN sid configuration test / Add associate test by @pguibert6WIND in #21386 bgpd: Dynamic capability parsing fixes by @ton31337 in #21603 nhrpd: stop debugging auth credentials by @mjstapp in #21615 bgpd: Consolidate redundant stream bounds checks in bgp_ls_decode_nlri by @cscarpitta in #21607 bgpd: Harden SRv6 Service Data parser for SID Structure length by @cscarpitta in #21612 bgpd: Clearly check for AS4 against 0 value by @ton31337 in #21610 isisd: consume leftover bytes after FAD sub-sub-TLV loop by @TristanInSec in #21544 bgpd: Prevent zero-length BGP-LS MT-ID TLV by @cscarpitta in #21600 bgpd: Reject BGP-LS Link NLRIs without Link Descriptor by @cscarpitta in #21609 tests: Remove show running bgpd from the topotests by @donaldsharp in #21629 Coverity cleanup some more items found by @donaldsharp in #21627 isisd: correct SRv6 End.X SID minimum size constants by @TristanInSec in #21541 bgpd: honor 'no activate' for dynamic neighbors in peer-group by @enissim in #21658 lib: mgmt: use SOMAXCONN for mgmtd socket listen backlog by @reinaldosaraiva in #21514 bgpd: Simplify BGP-LS NLRI TLV encoding by inlining helper functions by @cscarpitta in #21657 bgpd: migrate timers during peer_xfer_conn to fix stale route cleanup by @shashanka-ks in #21558 bgpd: Validate if NHC BGPID TLV value is non-zero by @ton31337 in #21611 isisd: Reject SRv6 Locator TLV with Loc-Size of zero by @cscarpitta in #21641 tests: bgp_suppress_fib was not stable before testing by @donaldsharp in #21649 bgpd: Do not allocate NHC TLV with an extra trailer by @ton31337 in #21606 bgpd: Avoid having a dangling pointer after we free NHC attribute by @ton31337 in #21605 bgpd: v4/v6 neigh advertised & received routes brief json by @hnattamaisub in #21411 tests: Update pytestmark value in scripts by @donaldsharp in #21684 static route bfd admin down state handling improvements by @sougatahitcs in #21400 bgpd: add advertisement-delay to hold route advertisements after startup by @karthikeyav in #21430 bgpd: Add support for BGP-LS for BGP fabric by @cscarpitta in #20726 tests: fix uptime check in test_bgp_default_originate_2links.py by @enkechen-panw in #21480 bgpd: Do not reject the route if confederation AS matches peer AS by @ton31337 in #21532 isisd: Use LAN End.X context for SRv6 sub-sub-TLV parsing by @cscarpitta in #21589 bgpd: Add BGP_AIGP_TLV_MIN_LEN constant to easily read what it is by @ton31337 in #21608 isisd: validate ASLA sub-sub-TLV length before consuming bytes by @TristanInSec in #21542 pimd: reject truncated IP datagrams before IGMP/mtrace handling by @Jafaral in #21705 lib: fix mgmt_msg recv to deal with mis-alignment by @choppsv1 in #21651 isisd: Reject duplicate SRv6 SID Structure Sub-Sub-TLV by @cscarpitta in #21656 Pim fixes in test by @donaldsharp in #21691 ospfd: Fix setting of type by @donaldsharp in #21712 pimd: cap PIM Hello secondary address list parsing by @Jafaral in #21707 tests: Ensure test_bgp_vpnv4_per_nexthop_label.py actually has a chance by @donaldsharp in #21699 zebra: fix EVPN MACIP DEL flag mixup in neighbor delete path by @nick-bouliane in #21733 bgpd: move auto config flag from bgp to srv6 unicast policy by @lsang6WIND in #21735 bgpd: Fixed crash in bgp received-routes detail json and code cleanup by @sougatahitcs in #20930 bgpd: Use BGP_LS_TLV_SET macro to set present_tlvs bits by @cscarpitta in #21604 BFD miscellaneous fixes by @pguibert6WIND in #21613 bgpd: Replace BGP_LS_TLV_* macros with standard FRR FLAG macros by @cscarpitta in #21755 nhrpd: improve validation in packet parsing by @mjstapp in #21686 pimd: harden BSM group/RP parsing paths by @Jafaral in #21734 pimd: fix crash in JP agg list due to stale upstream entry by @soumyar-roy in #21704 pimd: Provide better ordering for calling pim_upstream_use_rpt by @donaldsharp in #21764 bgpd: fix NHT for link-local nexthops from global-address peers by @soumyar-roy in #21687 bgpd: dynamic neighbors not up with md5 in non default vrf by @hnattamaisub in #21467 zebra: Fix incorrect update of 'nhe_received' in route_entry_update_nhe() by @GaladrielZhao in #21104 ospf6d: reinstall routes after zebra reconnect by @florath in #21011 Gre fixes by @pguibert6WIND in #21300 bgpd: Add json support for show bgp vrfs cmd by @sougatahitcs in #21485 bgpd: Add some defences for AS4/ENCAP handling by @ton31337 in #21777 add successful commit info msg by @choppsv1 in #21711 bgpd: fix aggregate->count undercount when dampening is cleared by @enkechen-panw in #21786 Bgp crashes by @donaldsharp in #21778 lib, isisd, bgpd: BGP-LS add several tlvs by @hedrok in #21376 tests: Remove invalid link-params command from BGP-LS topotest configs by @cscarpitta in #21793 *: consolidate sockopt_ apis in sockopt.c module by @mjstapp in #21746 tests: Add evpn pytestmark to tests that are missing by @donaldsharp in #21782 bgpd: fix shutdown crash by restricting evpn cleanup to owner instance by @soumyar-roy in #21698 ospf6d: packet- and auth-handling improvements by @mjstapp in #21783 pathd: add optional params to no cmd versions for frr-reload by @hedrok in #21710 tests: Fix zebra_vrf_netns topotest by @donaldsharp in #21741 *: Support gcc 15 by @mjstapp in #21812 zebra: fix memleak in ip import-table rmap by @chiragshah6 in #21811 Some more bgp connection rework by @donaldsharp in #21810 tests: Catch core dumps after teardown has completed by @donaldsharp in #21697 bgpd: fix aggregate->count not decremented when route is dampened by @enkechen-panw in #21787 zebra: Allow quick flaps of interfaces to be handled properly in next… by @donaldsharp in #21769 mgmtd: add periodic notify mode with mode/mode_data and FE test support by @ashred-lnx in #21253 bgpd: Treat malformed BGP-LS TLV as NLRI discard per RFC 9552 by @cscarpitta in #21827 tests: Fix invalid escape warning in BGP-LS test by @cscarpitta in #21829 tests: Fix invalid ISIS max-lsp-lifetime in BGP-LS configs by @cscarpitta in #21828 bgpd: Reject BGP-LS node/link names containing non-printable characters by @cscarpitta in #21825 tests: bgp_community_change_update: use receivedPrefixDup counter by @enkechen-panw in #21816 bgpd: fix aggregate->count errors in ZAPI route notifications by @enkechen-panw in #21789 bgpd: fix EVPN VRF auto RT deletion collision by @kaffarell in #21808 bgpd: set mp_nexthop_len consistently in subgroup_default_originate() by @enkechen-panw in #21840 staticd: nexthop identity as path-list key, and per-route metric by @enkechen-panw in #21296 bgpd: EVPN rd all or specific rd options based route table by @chiragshah6 in #21843 Startup after crash issues by @donaldsharp in #21550 bfdd: avoid close(-1) in bfd_dplane_finish_late by @sougatahitcs in #21841 Sockunion cmp wrong by @donaldsharp in #21833 bgpd: fix F-bit incorrectly set after port flap by @shashanka-ks in #21839 bgpd: enforce guards consistently at aggregate count entry points by @enkechen-panw in #21837 bgpd: send dynamic ENHE capability to peer-group members by @hnattamaisub in #21817 zebra: add json support for svd vxlan type by @sougatahitcs in #20886 bgpd: add detail json fields for v4/v6 neigh adver & recev routes by @sougatahitcs in #20951 docs: evpn: Add new Linux VXLAN Dataplane section by @robinchrist in #21664 zebra: align ctx nh cursor with RIB when skipping DUPLICATE nexthops by @hnattamaisub in #21709 pimd: validate PIM LAN sources and cap neighbors by @Jafaral in #21747 zebra: tear down old L3VNI before adding new one on VNI value change by @enissim in #21757 lib: bound masklen values, don't assert by @mjstapp in #21628 ospfd: add instance shutdown command by @rzalamena in #21759 bgpd: use bgp_node_match() instead of bgp_node_get() in aggregate count by @enkechen-panw in #21862 bgpd: Add BGP-LS Extensions for SRv6 (RFC 9514) by @cscarpitta in #21830 bgpd: warmboot failure when wfi enabled by @Manpreet-k0 in #21818 bgpd: Allow no network .... form for safi = EVPN or MPLS_VPN by @donaldsharp in #21860 bgpd: Skip route clearing for peers that were never established by @krishna-samy in #21867 bgpd: A couple link-state nits by @ton31337 in #21842 zebra: route EVPN FDB/neighbor reads through dplane by @rjarry in #21206 bgpd: add EVPN local RT-2 MAC+IP leaking to unicast by @louis-6wind in #20005 yang: allow match-metric value of zero by @mjstapp in #21888 *: don't use static char buffer in srv6 zapi code by @mjstapp in #21884 ospf6d: Fix command output for default route by @hedrok in #21886 bgpd: Remove redundant BGP-LS NLRI forward declarations by @cscarpitta in #21895 Memory leak problems. by @donaldsharp in #21844 debian: add pkg.frr.tcmalloc build profile for tcmalloc support by @rminnikanti in #21866 doc: fix spell check in developer and user rst guide by @chiragshah6 in #21901 bgpd: Reject malformed SRv6 End.X sub-TLV payloads with leftover bytes by @cscarpitta in #21904 zebra: Fix docstr mismatches in show ip route by @mhrn83 in #21865 Log file cleanup by @donaldsharp in #21907 bgpd: only use srv6_l3service attr if it's present by @mjstapp in #21916 bgpd: fix aggregate route not removed on de-configuration by @enkechen-panw in #21025 bgpd: Use ST token for BGP-LS STATIC protocol in NLRI output by @cscarpitta in #21909 bgpd: Fix incorrect BGP_PATH_MULTIPATH flag when route becomes invalid by @yuxuehong in #21106 tools: Add bfd commands to support bundle generation by @donaldsharp in #21914 pimd: Auto-RP hardening for discovery and announcements by @Jafaral in #21745 bgpd: Fix missing Multi-Topology ID in BGP-LS NLRIs by @cscarpitta in #21910 ospfd: Implement rfc4222 Recommendation 1 and 2 by @dfedyk in #20936 pimd: MLAG: skip pim_register_join on non-DR by @hnattamaisub in #21920 bgpd: validate SRV6 service sid transposition values by @mjstapp in #21903 bgpd: delete GR stale routes when nexthop becomes unreachable by @karthikeyav in #21742 bgpd: Initialize BGP-LS Node MSD only after parsing it by @cscarpitta in #21929 bgpd: Harden BGP-LS Node NLRI descriptor length validation by @cscarpitta in #21938 lib: add missing hook_unregister_arg in mgmt_be_client_destroy by @routingrocks in #21940 zebra: show nexthop-group rib brief json by @hnattamaisub in #20953 bgpd: support brief json for bgp v4 and v6 neighbors route by @hnattamaisub in #21414 lib,pceplib: fix DNS resolver and PCEP memory leaks by @jaredmauch in #20034 Tc dplane conversion by @donaldsharp in #21883 Fix event bugs in ldpd/lib and fix bgp_bmp misshandling of memory that leads to a crash by @donaldsharp in #21952 bgpd: Add route-map based allowas-in for flexible route filtering by @karthikeyav in #20659 pimd: Fix crash when up->channel_oil is NULL by @usrivastava-nvidia in #21961 zebra: Get link from the correct netns for vxlan by @leonshaw in #8895 ospfd: eliminate direct origination of Type-5 LSAs on NSSA routers by @rzalamena in #20894 zebra: fix EVPN zero-RMAC in some situations by @chdxD1 in #21448 bgpd: Move some optional feature-specific attributes from struct attr to struct attr_extra by @ton31337 in #21859 ospf6d: fix missing updating the global table by @anlancs in #21960 bgpd: cancel LLGR stale timer on peer AF delete by @Z-Yivon in #21947 topotests: Add a topotest for the no bgp client-to-client reflection command by @PierreNeltner6WIND in #21754 bgpd: limit GR-stale NHT-unreach delete to GR helper context by @karthikeyav in #21942 bgpd: cancel BFD strict hold timer on peer delete by @Z-Yivon in #21926 bgpd: skip stalepath-timer clear for LLGR-negotiated AFI/SAFIs by @hnattamaisub in #21932 *: small fixes roll-up pile by @eqvinox in #21957 lib: remove netns_other.c (unused) by @eqvinox in #21973 tests: Add VRF support for check_ping command by @ton31337 in #21753 bgpd: Fix missing SRv6 advertisement with distribute bgp-fabric-link-state by @cscarpitta in #21912 bgpd: Format IGP Router-ID in BGP-LS NLRI based on protocol by @cscarpitta in #21908 bgpd: Fix BGP-LS Attribute Node Name TLV by @cscarpitta in #21951 *: GCC 16 warnings by @eqvinox in #21985 bgpd: BGPd crash due to multiple bnc entry linked to same peer. by @usrivastava-nvidia in #21962 bgpd: preserve IPv6 nexthops when importing EVPN IPv4 routes by @kaffarell in #21958 ospfd: remove unnecessary space by @anlancs in #21979 bgpd: initialise nh_flag attribute by @fdumontet6WIND in #21498 bgpd: Check boundaries when parsing NHC and Prefix SID attributes by @ton31337 in #21981 bgpd: Fix GR helper retaining stale routes after Hard Reset by @selva-nexthop in #21823 tools: Revert 'no interface' when no configuration for interface left by @hedrok in #20378 ospfd: quick neighbor feature with BFD by @nabahr in #21784 ospf6d: only allow positive time strings by @jeremie6wind in #21928 bgpd: validate rfapi subtlv before accessing data octets by @mjstapp in #21974 zebra: clean up VRF handling by using dataplane provided vrf_id by @maxime-leroy in #20318 lib, zebra: bound SRv6 locator name length in ZAPI by @jamestiotio in #21868 bgpd: random format string fixes by @eqvinox in #21999 bgpd: fix AS-path routemap corruption and stale multipath on bestpath, fix tests by @donaldsharp in #21982 bgpd: Fix missing SRv6 unicast SID cleanup on locator delete by @cscarpitta in #21948 BFD authentication support by @pguibert6WIND in #21678 topotests: fix parallel run hangs (mutini teardown, ExaBGP FIFO, Docker hosts) by @Jafaral in https://github.com/FRRouting/frr/pull/22007 ci: fail topotest step when parallel run lacks JUnit failures by @Jafaral in https://github.com/FRRouting/frr/pull/22011 tests: Use show module to get bgp's pid by @donaldsharp in https://github.com/FRRouting/frr/pull/22023 lib: warn once when process fd limit is very large by @Jafaral in https://github.com/FRRouting/frr/pull/22031 pimd: fix shared-LAN (S,G) MFC loop and expand ssm topotest by @Jafaral in https://github.com/FRRouting/frr/pull/21998 ospfd: prevent stale LSA from corrupting local OSPF DB after reboot by @Jafaral in https://github.com/FRRouting/frr/pull/20601 pimd: add IGMP/MLD proxy route-map filtering by @Jafaral in https://github.com/FRRouting/frr/pull/21906 Fix keychain acceptance in BFD authentication by @donaldsharp in https://github.com/FRRouting/frr/pull/22028 bgpd: fix attr comparison when using attr_intern_reuse cache by @mjstapp in https://github.com/FRRouting/frr/pull/22008 bgpd: Fix stack overflow when debug printing label information & BMP code by @ton31337 in https://github.com/FRRouting/frr/pull/22056 bgpd: Move OTC and IPv6 extended community attributes to attr_extra by @ton31337 in https://github.com/FRRouting/frr/pull/22021 staticd: add 'show static routes' command by @kaffarell in https://github.com/FRRouting/frr/pull/21232 ripd: add full RTE bounds check to response/request processing loops by @DeadPackets in https://github.com/FRRouting/frr/pull/21889 pceplib: Validate lengths during object decoding by @mjstapp in https://github.com/FRRouting/frr/pull/22032 tests: fix flaky IGMP source baseline in pim_boundary_acl by @Jafaral in https://github.com/FRRouting/frr/pull/22055 pimd: move dense (S,G) to sparse mode when an RP is added by @Jafaral in https://github.com/FRRouting/frr/pull/20003 tests: harden bgp_conditional_advertisement_track_peer convergence waits by @Jafaral in https://github.com/FRRouting/frr/pull/22057 pimd: fix AutoRP stale RPs and selective multicast joins, add missing docs by @Jafaral in https://github.com/FRRouting/frr/pull/22039 bgpd: bmp: don't prepend local-AS to AS_PATH in BMP updates by @kalash-nexthop in https://github.com/FRRouting/frr/pull/21815 pimd,tests: refactor PIM join prune packet generation by @rzalamena in https://github.com/FRRouting/frr/pull/21795 zebra: fix neighbor entries ns_id by @louis-6wind in https://github.com/FRRouting/frr/pull/22034 Cleanup of memory allocation and usage of events by @donaldsharp in https://github.com/FRRouting/frr/pull/21943 zebra: fix DVNI route encap type for IPv6 VTEPs by @Manpreet-k0 in https://github.com/FRRouting/frr/pull/21911 No kernel nhg original by @donaldsharp in https://github.com/FRRouting/frr/pull/21893 bgpd: Fix use-after-free for ORF case by @ton31337 in https://github.com/FRRouting/frr/pull/22080 zebra: Track netlink carrier changes value by @donaldsharp in https://github.com/FRRouting/frr/pull/22084 In a removal operation do not allow a creation of the route_node in bgp by @donaldsharp in https://github.com/FRRouting/frr/pull/21878 bgpd: Move srte_color from attr struct to bgp_path_info_extra by @ton31337 in https://github.com/FRRouting/frr/pull/22059 Revert "bgpd: do not flag old best as multipath when it is also the n… by @donaldsharp in https://github.com/FRRouting/frr/pull/22095 bgpd: Move link_bw from attr_extra to bgp_path_info_extra by @ton31337 in https://github.com/FRRouting/frr/pull/22093 bgpd: Skip route-map LPM optimisation for AF_FLOWSPEC by @ton31337 in https://github.com/FRRouting/frr/pull/22083 bgpd: Fix infinite loop in MRT route dump for oversized paths by @ton31337 in https://github.com/FRRouting/frr/pull/22082 tests: reap mutini zombies and skip post-teardown support bundles by @Jafaral in https://github.com/FRRouting/frr/pull/22096 build, lib, zebra: OpenBSD fixes by @eqvinox in https://github.com/FRRouting/frr/pull/22009 tests: add multi-edit test with commit for mgmtd by @choppsv1 in https://github.com/FRRouting/frr/pull/22010 zebra: fix missing cleaning vni entry by @anlancs in https://github.com/FRRouting/frr/pull/22079 tests: fix grpc topotest xdist collection mismatch in CI by @Jafaral in https://github.com/FRRouting/frr/pull/22048 tests: harden topotest gcov coverage setup and reporting by @Jafaral in https://github.com/FRRouting/frr/pull/22104 Fix some topotest skipping problems by @donaldsharp in https://github.com/FRRouting/frr/pull/22113 pimd: fix AutoRP holdtime parsing and minor cleanup by @Jafaral in https://github.com/FRRouting/frr/pull/22120 docker: Add snmptrapd to list of thingies to install by @donaldsharp in https://github.com/FRRouting/frr/pull/22125 bgpd: Cleanup debug memory on shutdown by @donaldsharp in https://github.com/FRRouting/frr/pull/22123 tests: Remove unknown pytest.mark.tools by @donaldsharp in https://github.com/FRRouting/frr/pull/22114 bgpd: Add vrf name to more bestpath debugs by @donaldsharp in https://github.com/FRRouting/frr/pull/22124 tests: fix bgp_soo topotest by separating IPv4/IPv6 address families by @enkechen-panw in https://github.com/FRRouting/frr/pull/22128 yang: use relative path for remaining route-map when clauses by @enkechen-panw in https://github.com/FRRouting/frr/pull/22127 bgpd: refactor bgp_aggregate_{increment,decrement} by @enkechen-panw in https://github.com/FRRouting/frr/pull/22126 pimd: guard NULL RP lookups in BSM and RP deletion paths by @Jafaral in https://github.com/FRRouting/frr/pull/22131 pimd: fix mapping agent AutoRP discovery packet size by @Jafaral in https://github.com/FRRouting/frr/pull/22121 mgmtd: fix link order for libmgmt_be_nb by @enkechen-panw in https://github.com/FRRouting/frr/pull/22119 ospf6d: bypass MinLSArrival for self-originated MaxAge LSAs by @hnattamaisub in https://github.com/FRRouting/frr/pull/22103 lib: test the right bytes in flowspec prefixes by @mjstapp in https://github.com/FRRouting/frr/pull/22138 bgpd: remove unneeded sort of communities in rmap delete by @mjstapp in https://github.com/FRRouting/frr/pull/22151 pimd: fix BSR failover RP not setting i_am_rp locally by @Jafaral in https://github.com/FRRouting/frr/pull/22157 bgpd: reorder parameters in bgp_remove_route_from_aggregate() by @enkechen-panw in https://github.com/FRRouting/frr/pull/22136 zebra: fix wrong comparision for nexthop by @anlancs in https://github.com/FRRouting/frr/pull/21503 bgpd: Set extended flag for NHC attribute when re-encoding by @ton31337 in https://github.com/FRRouting/frr/pull/22159 pimd: dense mode fixes and topotest coverage by @Jafaral in https://github.com/FRRouting/frr/pull/22115 pimd: BSR/C-RP fixes with expanded topotest coverage by @Jafaral in https://github.com/FRRouting/frr/pull/22117 bgpd: Avoid cluster list attribute truncation by @ton31337 in https://github.com/FRRouting/frr/pull/22081 pimd: fix multicast boundary list lifetime and ACL evaluation by @Jafaral in https://github.com/FRRouting/frr/pull/22122 bgpd: Fixes in comm/lcomm/ecomm str functions by @mjstapp in https://github.com/FRRouting/frr/pull/22176 bgpd: comment style modifications for verify source test by @PierreNeltner6WIND in https://github.com/FRRouting/frr/pull/22112 yang: Prefix mismatch in frr-zebra.yang by @y-bharath14 in https://github.com/FRRouting/frr/pull/22189 bgpd: Fix stale EVPN type-5 route for suppressed prefix during L3VNI bounce by @raja-rajasekar in https://github.com/FRRouting/frr/pull/21992 pimd: defer static mroute install until interfaces are ready by @Jafaral in https://github.com/FRRouting/frr/pull/22156 pimd: fix dense mode State Refresh relay forwarding by @Jafaral in https://github.com/FRRouting/frr/pull/22177 ospf: fix the return value for the invalid VRF name by @SindhuParvathi-Gopi in https://github.com/FRRouting/frr/pull/22161 bgpd: free srv6_l3service object in failed parse path by @mjstapp in https://github.com/FRRouting/frr/pull/22198 zebra: EVPN clean up stale L2 NH/NHG from kernel at startup by @Manpreet-k0 in https://github.com/FRRouting/frr/pull/22002 ospfd: validate extended prefix TLV before accessing prefix SID by @mjstapp in https://github.com/FRRouting/frr/pull/22215 bgpd: Limit as-path segments up to 255 by @ton31337 in https://github.com/FRRouting/frr/pull/22212 bgpd: Clearly put 4-bytes when encoding SAFI_FLOWSPEC MP_REACH msg by @ton31337 in https://github.com/FRRouting/frr/pull/22213 pimd: fix heap OOB write in BSM fragmenter by @Jafaral in https://github.com/FRRouting/frr/pull/22222 lib: use XSTRDUP/XFREE for yang_data value field by @enkechen-panw in https://github.com/FRRouting/frr/pull/22196 staticd: avoid XPath set_sort in ecmp_path_list_validate by @enkechen-panw in https://github.com/FRRouting/frr/pull/22118 zebra: Allow rnh evaluation for a queued and !installed rn by @donaldsharp in https://github.com/FRRouting/frr/pull/22221 ospfd: Validate PREFIX_SID subtlv len before accessing by @mjstapp in https://github.com/FRRouting/frr/pull/22218 bfdd: fix show bfd peers brief json output identical to show bfd peers by @JackeySparrow in https://github.com/FRRouting/frr/pull/22064 bgpd: Fix community string truncation for big community sets by @ton31337 in https://github.com/FRRouting/frr/pull/22160 zebra: remove unused struct buf_req by @iurmanj6WIND in https://github.com/FRRouting/frr/pull/22242 pimd: fix wrong endian convertion by @anlancs in https://github.com/FRRouting/frr/pull/22244 yang: inet type mismatch in frr-bfdd.yang by @y-bharath14 in https://github.com/FRRouting/frr/pull/22241 lib: Some smaller code fixes for typesafe hash _member function by @robinchrist in https://github.com/FRRouting/frr/pull/22233 bgpd: fix local rt2 mac+ip leak race conditions by @louis-6wind in https://github.com/FRRouting/frr/pull/21967 zebra: add dplane helpers to provide interface speed by @maxime-leroy in https://github.com/FRRouting/frr/pull/19412 bgpd: add LLGR to capability length validation switch by @guoguojia2021 in https://github.com/FRRouting/frr/pull/22249 bgpd: fixes for NH and aggregator attribute parsing by @mjstapp in https://github.com/FRRouting/frr/pull/22200 bgpd: remove duplicate snprintf in FlowSpec redirect VRF display by @guoguojia2021 in https://github.com/FRRouting/frr/pull/22272 bgpd: fix return NULL in bool function ecommunity_node_target_match by @guoguojia2021 in https://github.com/FRRouting/frr/pull/22273 eigrpd: fix out-of-bounds reads in SHA256 digest computation by @arshsmith in https://github.com/FRRouting/frr/pull/22271 bgpd: fix holdtime_ptr unsafe pointer aliasing in OPEN receive path by @guoguojia2021 in https://github.com/FRRouting/frr/pull/22270 Network Byte Order Fixes for Little Endian Machines by @donaldsharp in https://github.com/FRRouting/frr/pull/22251 bgpd: skip peers not activated for AFI/SAFI in bgp_gr_check_all_eors() (backport #22295) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22302 bgpd: Fix extended optional parameters handling in OPEN message (backport #22308) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22321 pceplib: slightly relax a pcep object validation (backport #22298) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22309 tools: Use the topotest log directory instead of /tmp (backport #22315) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22326 pceplib: add length validation for pcep obj decoders (backport #22318) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22335 zebra: bump dplane major version for 10.7 by @mjstapp in https://github.com/FRRouting/frr/pull/22337 Also build for linux/riscv64 on release (backport #22256) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22341 tools: Normalize aggregate-address command when doing frr-reload (backport #22284) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22344 bgpd,tests: improve validation of incoming oid arrays (backport #22116) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22379 tests, tools: Shutdown daemons in tests same order in systemd (backport #22314) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22382 tools: Fix frr-reload.py crashes with UnboundLocalError (backport #22378) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22386 pimd: use RFC 3973 dm graft retry period for retransmission (backport #22376) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22389 tests: Fix bgp conditional advertisement test to ensure route is received (backport #22327) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22384 bgpd: don't advertise LLGR stale routes to non-LLGR peers (backport #22297) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22400 tests: load frr.conf by default (backport #22398) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22415 bgpd: reduce ibuf_scratch size to match ibuf_work (backport #22347) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22393 pimd: run Assert for dense mode wrong-interface handling (backport #22377) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22424 pimd: compensate for missing WRVIFWHOLE upcall on old kernels (backport #22240) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22395 bgpd: fix strlcat/strlcpy size parameter in NOTIFICATION send path (backport #22279) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22431 Add restart_frr, document topotest router and daemon restart helpers (backport #22399) by @Jafaral in https://github.com/FRRouting/frr/pull/22435 yang: Swapped RPF lookup mode descriptions (backport #22375) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22437 doc, tests: require frr.conf and load_frr_config() in new topotests (backport #22420) by @Jafaral in https://github.com/FRRouting/frr/pull/22436 debian, redhat: 10.7.0 release preparation by @Jafaral in https://github.com/FRRouting/frr/pull/22438 bgpd: Ignore parsing ORF route-refresh messages (backport #22429) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22455 ospf6d: log KillNbr adjacency changes on interface down (backport #22459) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22462 pimd: fix BSR_PENDING timer being overwritten by BS liveness timer (backport #22460) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22463 Revert #20005 for stable/10.7 only by @ton31337 in https://github.com/FRRouting/frr/pull/22471 pimd: fix NOCACHE forwarding for non-connected sources and static mroute upcalls (backport #22466) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22487 pimd: fix elected BSR not updating when priority changes (backport #22465) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22477 bgpd: fix bmp connect deletion with source-interface (backport #22469) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22508 bgpd: Do not accept AIGP for OAD peers if not enabled (backport #22519) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22525 Merge pull request #22423 from rdemsystems/fix/bgp-extended-message-r… by @rdemsystems in https://github.com/FRRouting/frr/pull/22545 ospf6d: check length before accessing grace LSA TLVs (backport #22539) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22556 ldpd: check fec elem length before accessing (backport #22537) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22559 pimd: fix C-RP processing crash during BSR_PENDING state (backport #22467) by @Jafaral in https://github.com/FRRouting/frr/pull/22566 pimd: MLAG: gate FHR flag on DR check in wrvifwhole/wholepkt upcalls (backport #22529) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22572 *: fix overflow in comparator functions used by sorted containers (backport #22498) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22574 pimd: fix stack overflow and IGMPv3 fragmentation in group_retransmit_sources (backport #21047) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22604 pimd: clean stale upstream NHT tracking on RP delete (backport #22505) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22605 pimd: prefer kernel ingress on WRONGVIF when MFC iif is stale (backport #22607) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22624 lib: Print multicast-source-interface rmap match (backport #22612) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22618 pimd: allow WRONGVIF prefer-ingress with (*,G)-only ifchannel (backport #22626) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22641 bgpd: anchor parsed attr in bgp_nlri_parse_vpn to preserve srv6_l3service (backport #22492) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22620 Missing show run output (backport #22619) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22644 bgpd: fix const-qualifier build error with strrchr (backport #22642) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22647 pimd: do not proxy IGMP leave while other downstream receivers remain (backport #22622) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22658 pimd: defer join-group socket joins until the interface exists (backport #22634) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22668 bgpd: Validate NEXT_HOP attribute if we have NLRIs and MP_REACH_ATTR (backport #22637) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22660 pimd: avoid stale RPF ifp during vrf/interface events (backport #22650) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22669 bgpd: don't emit "no neighbor X capability link-local" for unnumbered… (backport #22540) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22664 10.6.1 What's Changed doc: fix indentation error in pim doc (backport #21373) Fix/bgp hardening backports 10.6 isisd: improve validation of flex-algo decoder (backport #21314) bgpd: Do not allocate stream if route-refresh capability is not received (backport #21394) bgpd: Check dynamic capability action before validating ENHE capability (backport #21395) bgpd: Do not allow triggering route-refresh path with a malformed ORF length (backport #21399) pimd: guard channel OIL detach against stale pointers (backport #21431) ospfd: add validation in several places before accessing message bodies (backport #21303) pimd: fix NOCACHE MFC resync detection log, add vrf name too (backport #21481) bgpd: Fix mixed remote-as for peer-groups when using auto (backport #21406) bgpd: Don't mark nexthop as changed if a set next-hop unchanged is applied (backport #21445) ospfd: add LSA validation in the apiserver path (backport #21536) eigrpd: reject invalid prefix mask len (backport #21539) eigrpd: enforce minimum TLV length in Hello handler (backport #21543) isisd: use correct min size values for srv6 subtlvs (backport #21540) bgpd: fix neighbor IP comparison for IPv6 memcmp return values (backport #21559) bgp_evpn: fix memleak when configuring rd (backport #21566) eigrpd: fix byte order in Hello authentication decode (backport #21545) lib: Report IPv6 MTU and not IPv4 for if_update_state_mtu6 (backport #21501) bgpd: Prevent out-of-bound reading handling soft version dynamic capability (backport #21602) isisd: continue hardening SRV6 tlv parsing (backport #21585) bgpd: Dynamic capability parsing fixes (backport #21603) isisd: consume leftover bytes after FAD sub-sub-TLV loop (backport #21544) bgpd: Harden SRv6 Service Data parser for SID Structure length (backport #21612) nhrpd: stop debugging auth credentials (backport #21615) bgpd: honor 'no activate' for dynamic neighbors in peer-group (backport #21658) bgpd: migrate timers during peer_xfer_conn to fix stale route cleanup (backport #21558) isisd: correct SRv6 End.X SID minimum size constants (backport #21541) isisd: Reject SRv6 Locator TLV with Loc-Size of zero (backport #21641) bgpd: Validate if NHC BGPID TLV value is non-zero (backport #21611) bgpd: Check if BGPID NHC TLV exists when IPv6 next-hop is link-local (backport #21377, #21605, #21611) Signed-off-by: Adolf Belka Signed-off-by: Michael Tremer commit d692769d94c752225a7cc48b378be8c389939b56 Author: Adolf Belka Date: Sat Aug 8 15:07:03 2026 +0200 fort-validator: Update to version 1.6.8 - Update from version 1.6.7 to 1.6.8 - No change in rootfile - 1 GHSA fix - Changelog 1.6.8 GHSA-qfm3-577x-rh54: Prevent RRDP cache poisoning #112: Refuse cross-origin RRDP #175: Skip hidden files and directories when synchronizing via Rsync 016f399: Reject negative certificate serial numbers Signed-off-by: Adolf Belka Signed-off-by: Michael Tremer commit e1f5b0c63e6cb6c0c82980d3068612adb5c98ec4 Author: Adolf Belka Date: Sat Aug 8 12:34:14 2026 +0200 dnsdist: Update to version 2.1.1 - Update from version 2.1.0 to 2.1.1 - No change in rootfile - Changelog 2.1.1 Bug Fixes Account for the existing content when parsing labels References: #17790, #17797, pull request 17858 Do not index past the address for byte-aligned prefixes References: #17835, pull request 17860 Signed-off-by: Adolf Belka Signed-off-by: Michael Tremer commit 6bfebc4000db303515821b3a6b7ae3873041ec34 Author: Adolf Belka Date: Sat Aug 8 12:34:13 2026 +0200 core205: Ship shadow Signed-off-by: Adolf Belka Signed-off-by: Michael Tremer commit c3683dff25fa535af812fb91163dfb820048672d Author: Adolf Belka Date: Sat Aug 8 12:34:15 2026 +0200 shadow: Update to version 4.20.0 - Update from version 4.18.0 to 4.20.0 - Update of rootfile - Addition of patch to fix a build error. This patch will be integrated into the next tarball release. - Checked the sobump but no dependencies found. - Changelog 4.20.0 Removals: The following programs and features were deprecated in 4.19 (Herve) or earlier, and have been removed in 4.20. expiry(1) (deprecated in 4.19) See #1481 and #1432. login.defs(5): ENCRYPT_METHOD: DES (deprecated in 4.19) See #1456. login.defs(5): ENCRYPT_METHOD: MD5 (deprecated in 4.19) See #1457. login.defs(5): MD5_CRPYT_ENAB (deprecated since the dinosaurs were around) See #1455. shadow(5): .sp_min (deprecated in 4.19) See #1482. This also includes the following removals: chage(1): -m,--mindays (also the interactive version) passwd(1): -n,--mindays login.defs(5): PASS_MIN_DAYS This feature is considered a vulnerability, and was removed without replacement. Programs will now fail when any of those flags or variable are specified. This is intentional, and should help identify any scripts that rely on these. groupmems(8) (deprecated in 4.19) See #1343 and #1601. Use usermod(8) instead. logoutd(8) (deprecated in 4.19) See #999 and #1344. Defaults: The following default values were changed. login.defs(5): Remove defaults for password expiration (PASS_MAX_DAYS, PASS_WARN_AGE) See #1428. login.defs(5): ENCRYPT_METHOD: Default to SHA512 (previously, it was DES) See #1278 and #1454. Users should still explicitly specify it, since other programs that read login.defs(5) may still default to DES. Features The following features that were optional in 4.19 are now unconditionally supported in 4.20. SHA256, SHA512 See #1278 and #1452. Regressions Some regressions have been introduced (as side effects of bug fixes) and they're here to stay. Users must adapt. #1704 su(1) as root can be dangerous because of an ioctl (TIOCSTI), and if that ioctl is not disabled, su(1) will now fail and report an error. #1706 usermod(8) doesn't produce any effects if it fails to unlock a password because there was no password. Previously, this was just a warning, and thus produced effects. Dependencies: We've removed an unused dependency (libattr). See #1473. Deprecations No new deprecations since 4.19. However, we maintain the deprecations from then. Here's a reminder of deprecated features that have not been removed yet (they will eventually be removed): Password aging: chage(1): -I,--inactive (also the interactive version) -M,--maxdays (also the interactive version) -W,--warndays (also the interactive version) passwd(1): -k,--keep-tokens -x,--maxdays -i,--inactive -w,--warndays useradd(8): -f,--inactive usermod(8): -f,--inactive login.defs(5): PASS_MAX_DAYS PASS_WARN_AGE /etc/default/useradd: INACTIVE shadow(5): .sp_lstchg: Restrict to just the values 0 and empty. .sp_max .sp_warn .sp_inact 4.19.4 Regression fixes: - Build with GCC 10 and older. 4.19.3 Regression fixes: - chpasswd(8): - Don't reject hashes containing backslashes or 'n' characters (affected SHA-256, SHA-512, MD5). 4.19.2 Regression fixes: - usermod(8): - Revert an incorrect commit. See and . 4.19.1 Regression fixes: - chpasswd(8): - Don't reject leading '!' in password hashes or a hash consisting of "*". These were accidentally rejected in 4.19.0. See and . - Accept a passwordless account ("" or "!"). See and . 4.19.0 Breaking changes: Remove support for escaped newlines in configuration files. It never worked correctly. b0a7ce5 (2025-12-05; "lib/, po/: Remove fgetsx() and fputsx()") Some user names and group names are too dangerous and are rejected, even with --badname. 25aea74 (2025-12-25; "lib/chkname.c, src/: Strictly disallow really bad names") Future breaking changes: SHA512 and SHA256 will be supported unconditionally in the next release. The build-time flag '--with-sha-crypt' will be removed. See #1452. Support: Several years ago, there were talks about deprecating su(1) and login(1), back when this project was maintained as part of Debian. However, nothing was clearly stated, and there were doubts about the status of these programs. Let's clarify them now. Our implementations of su(1) and login(1) are fully supported, and we don't have any plans to remove them. They are NOT deprecated. See #464. Deprecations: groupmems(8) The program will be removed in a future release. See #1343. logoutd(8) The program will be removed in the next release. See #999, and #1344. DES This hashing algorithm has been deprecated for a long time, and support for it will be removed in a future release. See #1456 MD5 This hashing algorithm has been deprecated for a long time, and support for it will be removed in a future release. See #1457 login.defs(5): MD_CRYPT_ENAB This feature had been deprecated for decades. It will be removed in a future release. The command-line equivalents (-m, --md5) of this feature in chpasswd(8) and chgpasswd(8) will also be removed in a future release. See #1455. login.defs(5): PASS_MAX_LEN This feature is ignored except for DES. Once DES is removed, it makes no sense keeping it. It may be removed in a future release. Password aging Scientific research shows that periodic password expiration leads to predictable password patterns, and that even in a theoretical scenario where that wouldn't happen the gains in security are mathematically negligible. https://people.scs.carleton.ca/~paulv/papers/expiration-authorcopy.pdf Modern security standards, such as NIST SP 800-63B-4 in the USA, prohibit periodic password expiration. https://pages.nist.gov/800-63-4/sp800-63b.html#passwordver https://pages.nist.gov/800-63-FAQ/#q-b05 https://www.ncsc.gov.uk/collection/passwords/updating-your-approach#PasswordGuidance:UpdatingYourApproach-Don'tenforceregularpasswordexpiry To align with these, we're deprecating the ability to periodically expire passwords. The specifics and long-term roadmap are currently being discussed, and we invite feedback from users, particularly from those in regulated environments. See #1432. This deprecation includes the following programs and features: expiry(1) chage(1): -I,--inactive (also the interactive version) -m,--mindays (also the interactive version) -M,--maxdays (also the interactive version) -W,--warndays (also the interactive version) passwd(1): -k,--keep-tokens -n,--mindays -x,--maxdays -i,--inactive -w,--warndays useradd(8): -f,--inactive usermod(8): -f,--inactive login.defs(5): PASS_MIN_DAYS PASS_MAX_DAYS PASS_WARN_AGE /etc/default/useradd: INACTIVE shadow(5): sp_lstchg: Restrict to just the values 0 and empty. sp_min sp_max sp_warn sp_inact We recognize that many users operate in environments with regulatory or contractual requirements that still mandate password aging. To minimize disruption, these features will remain functional for a significant period. However, we encourage administrators to review their internal policies, talk to their regulators if appropriate, and participate in the roadmap discussion linked above. Signed-off-by: Adolf Belka Signed-off-by: Michael Tremer commit 8be727e203c726186dd5649d433982d361bc0aa7 Author: Adolf Belka Date: Sat Aug 8 12:34:12 2026 +0200 clamav: Update to version 1.5.4 - Update from version 1.5.3 to 1.5.4 - Update of rootfile - 8 CVE Fixes plus a fix for a rust advisory - Changelog 1.5.4 - [CVE-2026-20337](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20337): Fixed ZIP catalogue capacity tracking that could write beyond a heap allocation while indexing local file headers. This issue affects ClamAV 1.5.0 through 1.5.3. The fix is included in 1.5.4. Thank you to Kevin Stubbings of the GitHub Security Lab team for identifying this issue. - [CVE-2026-20345](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20345): Fixed an indexing error while converting GPT partition names that could read or write beyond a stack-allocated partition entry. This issue affects ClamAV 0.98.2 through 1.5.3. The fix is included in 1.4.6 and 1.5.4. Thank you to Atuin - Automated Vulnerability Discovery Engine, Tianchu Chen of Tencent Xuanwu Lab for identifying this issue. - [CVE-2026-20339](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20339): Fixed an integer overflow in the PESpin unpacker that could allocate an undersized buffer and then write beyond it while rebuilding a PE file. This issue affects ClamAV 0.90 through 1.5.3. The fix is included in 1.4.6 and 1.5.4. Thank you to Feng Xue and, independently, Yazdan Soltani for identifying this issue. - [CVE-2026-20338](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20338): Fixed ownership handling while merging ZIP catalogue records that could cause an invalid free while scanning a malformed archive. This issue affects ClamAV 1.5.0 through 1.5.3. The fix is included in 1.5.4. Thank you to Daggolu Rakesh and, independently, Yazdan Soltani for identifying this issue. - [CVE-2026-20346](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20346): Fixed an integer underflow in the PDF parser that could cause a crash while reading a malformed hex string. This issue affects ClamAV 1.4.5 and earlier, and ClamAV 1.5.0 through 1.5.3. The fix is included in 1.4.6 and 1.5.4. Thank you to Tristan (@TristanInSec) for identifying this issue. - [CVE-2026-20347](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20347): Fixed undefined behavior and integer overflow in the Mach-O parser that could cause a crash while scanning a malformed Mach-O file. This issue affects ClamAV 1.4.5 and earlier, and ClamAV 1.5.0 through 1.5.3. The fix is included in 1.4.6 and 1.5.4. Thank you to Tristan (@TristanInSec) for identifying this issue. - [CVE-2026-20348](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20348): Fixed XAR parser size handling that could request an excessive allocation or exceed scan limits while decompressing a malformed table of contents. This issue affects ClamAV 0.98.1 through 1.5.3. The fix is included in 1.4.6 and 1.5.4. Thank you to leduckhuong for identifying this issue. - [CVE-2025-8088](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8088): Adopted the upstream UnRAR project fix in ClamAV's bundled UnRAR library. The fix rejects path separators in NTFS alternate data stream names to prevent extraction outside ClamAV's temporary scan directory on Windows. This issue affects ClamAV 0.101.0 through 1.5.3. The fix is included in 1.4.6 and 1.5.4. Thank you to Yazdan Soltani for identifying that this issue affects ClamAV. - Fixed thread-safety issues in the `clamd` STATS command that could disclose process memory or crash the daemon while scans and STATS requests run concurrently. Also fixed partial socket-write handling used for large STATS responses. This issue affects ClamAV 0.95 through 1.5.3. The fix is included in 1.4.6 and 1.5.4. - FreeBSD: Restored support for safe quarantine move and remove actions while preserving protection against source-path replacement races. This issue affects ClamAV 1.4.5 and 1.5.3. The fix is included in 1.4.6 and 1.5.4. - Fixed an OpenSSL library-context leak in legacy hashing helpers when a requested message digest cannot be fetched, such as when the default provider is unavailable in a FIPS-enabled environment. This issue affects ClamAV 1.5.0 through 1.5.3. The fix is included in 1.5.4. - Upgraded the Rust `crossbeam-epoch` dependency to resolve the RUSTSEC-2026-0204 advisory. Signed-off-by: Adolf Belka Signed-off-by: Michael Tremer commit de065a0192e7969152ea27a1a18290ccdc270fe9 Author: Adolf Belka Date: Fri Aug 7 22:33:57 2026 +0200 core205: Ship xfsprogs Signed-off-by: Adolf Belka Signed-off-by: Michael Tremer commit 0cbb458549f2924f43c4c1d47f25d92fffc48b65 Author: Adolf Belka Date: Fri Aug 7 22:34:10 2026 +0200 xfsprogs: Update to version 7.1.1 - Update from version 7.0.1 to 7.1.1 - No change in rootfile - Changelog 7.1.1 xfsprogs: healer: install targets one at a time (Allen Hewes) fiemap: add a nosync option (Pankaj Raghav) xfs_scrub: fix spacemap scan for data volume (Darrick J. Wong) mdrestore: fix extent length overflow in v2 restore path (Manognya Singuru) 7.1.0 fsr: preserve xfrog_bulkstat error codes (liuh) xfs_scrub: fix spacemap scan for internal rt devices (Darrick J. Wong) mkfs: PQUOTA shouldn't conflict with GQNOENFORCE (Darrick J. Wong) mkfs: fix hardlink detection in directory import code (Darrick J. Wong) xfs_protofile: make nondirectory arguments actually work (Darrick J. Wong) mkfs: fix symlink target length check in create_nondir_inode (Darrick J. Wong) mkfs: don't redefine DIRT for protofiles (Darrick J. Wong) xfs_healer: fix getmntent race in weakhandle (Darrick J. Wong) xfs_db: dump zoned filesystem superblock fields (Darrick J. Wong) xfs_db: fix type conversions (Darrick J. Wong) xfs_scrub: fix estimate of work items for phase 4 (Darrick J. Wong) xfs_scrub: always finish cleanup, even if reporting healthy state fails (Darrick J. Wong) xfs_scrub: fix phase 8 debug reporting (Darrick J. Wong) xfs_scrub: don't leak phase 5 scan items after a failed workqueue_add (Darrick J. Wong) xfs_scrub: warn about difficult rtgroup repairs (Darrick J. Wong) xfs_scrub: don't leak the autofsck fsproperty handle (Darrick J. Wong) xfs_scrub: account for reflinked realtime file data (Darrick J. Wong) xfs_scrub: account only data extent tail after an overlap (Darrick J. Wong) xfs_scrub: report external log space usage in phase 7 (Darrick J. Wong) xfs_scrub: warn about incomplete repairs if we never get to them (Darrick J. Wong) xfs_scrub: handle media scans of internal rt devices correctly (Darrick J. Wong) xfs_scrub: report bad file ranges correctly (Darrick J. Wong) xfs_scrub: handle missing media verify ioctl failure return codes (Darrick J. Wong) mkfs: fix filesystem and log size units (Manognya Singuru) xfs_healer: don't put the slice file in LDIRT (Darrick J. Wong) xfs_healer: allow AF_UNIX socket access for xfs_healer instances (Darrick J. Wong) xfs_healer_start: fix static checking (Darrick J. Wong) xfs_healer_start: check listmount when doing a --check (Darrick J. Wong) xfs_scrub: read verification isn't ok if it hit runtime errors (Darrick J. Wong) xfs_scrub: don't obscure repair failures in repair_list_schedule (Darrick J. Wong) xfs_scrub: don't crash trying to complain about clean health (Darrick J. Wong) xfs_scrub: don't continue with phase1 if autofsck=none (Darrick J. Wong) xfs_scrub: don't allow NAN as fstrim percentage (Darrick J. Wong) xfs_scrub: fix nonsense advice after a scrub finds errors (Darrick J. Wong) xfs_scrub: return SCRUB_RET_OPERROR if unicode collision detection fails to initialize (Darrick J. Wong) xfs_scrub: don't report media errors in specially-owned areas as file data (Darrick J. Wong) xfs_scrub: fix work estimation for rtgroups filesystems (Darrick J. Wong) xfs_scrub: don't count internal log space in the data device used count (Darrick J. Wong) xfs_scrub: fix integer overflows (Darrick J. Wong) xfs_scrub_fail: send content headers for xfs_scrub_all failures (Darrick J. Wong) xfs_scrub_all_fail: reduce security lockdowns to avoid postfix problems (Darrick J. Wong) xfs_scrub_all: fix broken command line string array construction (Darrick J. Wong) xfs_scrub_media_fail: reduce security lockdowns to avoid postfix problems (Darrick J. Wong) xfsprogs: include/buildrules: fix ltdep (Romain Naour) xfs_healer: coordinate access to weakhandle::mntpoint correctly (Darrick J. Wong) xfs_healer: don't leak wh->mntpoint if fd_to_handle fails (Darrick J. Wong) xfs_healer: fix Makefile errors (Darrick J. Wong) xfs_healer: run a full xfs_scrub repair if we don't know how to do a spot repair (Darrick J. Wong) xfs_healer: recommend offline fsck for XCORRUPT repairs (Darrick J. Wong) xfs_healer: fix error reporting (Darrick J. Wong) Signed-off-by: Adolf Belka Signed-off-by: Michael Tremer commit 0f49c2d75a2da499c4ce3430a740fa7b5a857485 Author: Adolf Belka Date: Fri Aug 7 22:33:56 2026 +0200 core205: Ship systemd Signed-off-by: Adolf Belka Signed-off-by: Michael Tremer commit 809752ad05d48e74fb530df2671bc9e061561a60 Author: Adolf Belka Date: Fri Aug 7 22:34:09 2026 +0200 systemd: Update to version 261.2 - Update from version 261.1 to 261.2 - No change in rootfile - Changelog 261.2 https://github.com/systemd/systemd/compare/v261.1...v261.2 5 udev specific commits 16 commits that reference udev in some way Signed-off-by: Adolf Belka Signed-off-by: Michael Tremer commit e8b349a18216085ef8c09e7c4bb1feef0f08dfaf Author: Adolf Belka Date: Fri Aug 7 22:33:55 2026 +0200 core205: Ship sqlite Signed-off-by: Adolf Belka Signed-off-by: Michael Tremer commit 4e6180f5abe6625afadd32748c3bc80cfb06e269 Author: Adolf Belka Date: Fri Aug 7 22:34:08 2026 +0200 sqlite: Update to version 3530400 - Update from version 3530300 to 3530400 - Update of rootfile - Changelog 3530400 Fixes for problems in 3.53.0 (and 3.53.1, 3.53.2, and 3.53.3) mostly coming from AIs. See the check-in timeline for details. Signed-off-by: Adolf Belka Signed-off-by: Michael Tremer commit 2751eebc46614315a87dc4a3247efd4fdbb0bdb0 Author: Adolf Belka Date: Fri Aug 7 22:34:07 2026 +0200 samba: Update to version 4.24.5 - Update from version 4.24.2 to 4.24.5 - No change to the rootfiles - 6 CVE Fixes in 4.24.5 & 6 in 4.24.3 - Changelog 4.24.5 This is a security release in order to address the following defects: o CVE-2026-6949: TSIG packet with name compression can crash DNS Incorrect size calculations when a TSIG record contains compressed names can lead to a large out-of-bounds write causing the server to crash. https://www.samba.org/samba/security/CVE-2026-6949.html o CVE-2026-58216: An authenticated user could possibly crash a KDC process A kpasswd packet that contains malformed ASN.1 might cause the server to access 6 bytes of unallocated memory. This memory is not exposed to the user, but in some circumstances the server could crash. https://www.samba.org/samba/security/CVE-2026-58216.html o CVE-2026-58218: DNS signing DoS via TKEY name cache exhaustion An unauthenticated user can repeatedly register names TKEY names, which floods a cache causing legitimate TKEYs to be expunged. This can practically block the use DNS TSIG signing. https://www.samba.org/samba/security/CVE-2026-58218.html o CVE-2026-58221: Samba AD authenticated LDAP access domain takeover Samba AD low-privilege authenticated LDAP access allows modifications to internal LDB special DNs, which permits a domain takeover. https://www.samba.org/samba/security/CVE-2026-58221.html o CVE-2026-58222: Samba AD LDAP Compare filter injection and trusted-request confusion disclose protected attributes An ordinary authenticated domain user can bypass access checks and query confidential Active Directory attributes (such as KDS root keys) via LDAP Compare requests. Due to a filter injection flaw and trusted execution context, the LDAP Compare operation can be turned into a protected-attribute disclosure oracle. https://www.samba.org/samba/security/CVE-2026-58222.html o CVE-2026-58224 The CTDB protocol has bounds checking issues CTDB fails to do integrity checking of received packets. This includes failure to check field lengths against packet lengths when unmarshalling packets. https://www.samba.org/samba/security/CVE-2026-58224.html 4.24.4 * BUG 16095: Use-after-free in handling acls with claims and conditions * BUG 16092: Compilers may ignore overflow checks - Fix tautological-compare warnings * BUG 14638: restrict anonymous = 2 breaks RODC functionality * BUG 16006: warning: assignment discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers] * BUG 16067: Require NTLMv2 session security on Windows makes trusts to Samba unusable * BUG 16092: Compilers may ignore overflow checks - Fix tautological-compare warnings * BUG 16151: winbindd stuck in init_dc_connection_rpc() returning NT_STATUS_TRUSTED_DOMAIN_FAILURE * BUG 16006: warning: assignment discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers] * BUG 16149: domain\user not split when provided as username in smbc_set_credentials_with_fallback() 4.24.3 This is a security release in order to address the following defects: o CVE-2026-1933: Missing access checks on reparse point operations On a share marked "read only = yes" and on file handles opened R/O users can set or delete the reparse point xattrs on files that the user has write-access in the file system for. https://www.samba.org/samba/security/CVE-2026-1933.html o CVE-2026-2340: WORM vfs module does not block overwrites The WORM (Write-Once, Read Many) vfs module is supposed to lock write access to shared files, so they cannot be altered after initial writes. It was allowing files to be overwritten by renaming a newly created file over a protected file. https://www.samba.org/samba/security/CVE-2026-2340.html o CVE-2026-3012: auto-enrolment GPO installing CA certificate over http without verification To bootstrap a certificate chain a domain member must fetch a certificate without TLS. It was trusting HTTP for this when a more secure encrypted LDAP channel was also available. https://www.samba.org/samba/security/CVE-2026-3012.html o CVE-2026-3238: Denial of service against AD DC WINS server The WINS server component of the Active Directory Domain controller code in Samba is vulnerable to a NULL pointer dereference and crash caused by a unauthenticated UDP packet. https://www.samba.org/samba/security/CVE-2026-3238.html o CVE-2026-4408: Unauthenticated Remote Code Execution in Samba DCE/RPC SAMR server Samba file servers and classic (non-AD) domain controllers with samba-dcerpcd started as a system service and with a "check password script" that has the %u substitution character are vulnerable to a remote code execution. https://www.samba.org/samba/security/CVE-2026-4408.html o CVE-2026-4480: Unauthenticated Remote Code Execution in Samba printing subsystem Samba print servers with a "print command" that has the %J substitution character are vulnerable to a Remote Code Execution. https://www.samba.org/samba/security/CVE-2026-4480.html Signed-off-by: Adolf Belka Signed-off-by: Michael Tremer commit 5dc07fb29509b6509d91cb8f873ea4c1dd6860d6 Author: Adolf Belka Date: Fri Aug 7 22:34:06 2026 +0200 postfix: Update to version 3.11.5 - Update from version 3.11.4 to 3.11.5 - No change in rootfile - Changelog 3.11.5 Major changes - database [Incompat 20260220] The alias_maps and alias_database parameter default values have changed from hash:/path/to/aliases (or dbm:/path/to/aliases) to $default_database_type:/path/to/aliases. This simplifies the migration away from Berkeley DB. [Infrastructure 20260219] Support to migrate a Postfix configuration that uses Berkeley DB hash: or btree: tables, to a configuration that uses lmdb: or a combination of cdb: and lmdb:. This is needed for (Linux) OS distributions that have removed Berkeley DB support. See NON_BERKELEYDB_README for manual and automatic migration support. Postfix already supports CDB and LMDB for more than 10 years. It may be a good idea to do the migration before you need to upgrade to an OS distribution that no longer supports Berkeley DB. [Infrastructure 20251226] Tooling to help with the migration away from Berkeley DB. The new parameter default_cache_db_type controls the default database type for address_verify_map, postscreen_cache_map, and smtp_sasl_auth_cache_name, previously hard-coded as 'btree'. [Feature 20250321] Safety: the SQLite client now logs a warning when a query uses double quotes instead of the Postfix-recommended single quotes. Only the recommended form is protected against SQL injection. [Feature 20250509] Support to run all memcache lookup keys through an OpenSSL digest function. This prevents a database access error when lookup keys may exceed the memcache server's key length limit (usually, 250 bytes). [Feature 20250624] Support for a new "debug:" pseudo lookup table. Specify debug:maptype:mapname to encapsulate a maptype:mapname lookup table and log all access. This builds on existing but unused code to log table access. Contributed by Richard Hansen. [Infrastructure 20250626] Overhauled in-memory lookup table life-cycle management; overhauled sharing/isolation for proxied lookup tables. Major changes - deprecation [Feature 20250609] smtp_tls_enforce_peername and lmtp_tls_enforce_peername are now officially deprecated. Postfix will log a warning until the features are deleted. See DEPRECATION_README for a summary of deprecated and deleted features. [Feature 20251027] This adds 12 more deprecation warnings for parameters that have been renamed in the past, and that still provide a backwards-compatible default value for their replacement. The parameters deprecated by this change are: authorized_verp_clients, fallback_relay, lmtp_per_record_deadline, postscreen_blacklist_action, postscreen_dnsbl_ttl, postscreen_dnsbl_whitelist_threshold, postscreen_whitelist_interfaces, smtpd_client_connection_limit_exceptions, smtp_per_record_deadline, tlsproxy_client_level, tlsproxy_client_policy, virtual_maps. [Feature 20251028] Deprecate the smtp_cname_overrides_servername and lmtp_cname_overrides_servername parameters, and delete documentation that has been obsolete since Postfix 2.11. Major changes - logging [Feature 20250910] TLS feature policy status summary in delivery status logging. This shows the desired and actual TLS security level enforcement status and, if a message requests REQUIRETLS, the REQUIRETLS policy enforcement status. For a list of examples see https://www.postfix.org/postconf.5.html#smtp_log_tls_feature_status [Feature 20251216] After a delivery failure, the bounce daemon logged ": sender non-delivery notification: " only if the notification was queued successfully. The bounce daemon now always logs this, making Postfix behavior easier to understand. Visible changes for logfile analyzers: - The bounce daemon now logs ": sender non-delivery notification: " BEFORE the cleanup daemon logs activity with "". Previously, the bounce daemon logged the old<=>new queue ID connection later, which made logfile analysis more difficult. - The bounce daemon now logs a logfile record ": sender notification failed to
: " when the notification was not queued. In some cases it will log ": sender notification failed to
" (without the reason). In those cases the failure reason was already logged by lower-level code, but without the queue ID. Major changes - management tool integration [Feature 20251124] Basic JSON output support with "postconf -j|-jM|-jF|-jP", "postalias -jq|-js", "postmap -jq|-js", and "postmulti -jl". No support is planned for JSON input support. Major changes - milter support [Feature 20251208] Improved Milter error handling for messages that arrive over a long-lived SMTP connection, by changing the default milter_default_action from "tempfail" to the new "shutdown" action (i.e. disconnect the remote SMTP client). This avoids a worst-case scenario where after a single Milter error, Postfix would tempfail all messages that the client sends over a long-lived connection, even if the Milter error was only temporary. Major changes - mime support [Feature 20251104] New non_empty_end_of_header_action parameter with the cleanup(8) server action when a primary message header is terminated with a non-empty line: 1) fix_quietly: Insert an empty line before the offending text (the backwards-compatible default), 2) add_header: Insert a MIME-Error: header before inserting an empty line, or 3) reject: Log a "mime-error" and reject the message. Note that the 'empty line' separator is not used for DKIM signature checks. Therefore, adding a missing separator does not break DKIM. Major changes - mta-sts [Feature 20250906] Workaround for an interface mis-match between the Postfix SMTP client and MTA-STS policy plugins. This introduces a new parameter "smtp_tls_enforce_sts_mx_patterns" (default: "yes"). The MTA-STS plugin configuration needs to enable TLSRPT support, so that it forwards STS policy attributes to Postfix. This works even if Postfix TLSRPT support is disabled at build time or at runtime. With the above two configurations, the Postfix SMTP client will connect to an MX host only if its name matches any STS policy MX host pattern, and will match a server certificate against the MX hostname. Otherwise, the old behavior stays in effect: connect to any MX host listed in DNS, and match a server certificate against any STS policy MX host pattern. This code was published first in Postfix 3.11, and later back-ported to Postfix 3.10.5. Major changes - portability [Feature 20241201] Support for the C23 built-in bool type. Older Postfix releases have been updated with a makedefs script that disables C23 built-in bool support. Major changes - postqueue [Feature 20251218] the postqueue (and mailq) command now also lists recipients in bounce logfiles (in JSON output, this uses a new object member 'bounce_reason' instead of the existing 'delay_reason'). Such recipients have already been deleted from the message queue file, but they are still pending the creation of a non-delivery status notification message that will be returned to the sender. Major changes - relocated_maps [Feature 20250608] Specify "relocated_prefix_enable = no" to disable the hard-coded prefix "5.1.6 User has moved to " that is by default prepended to all relocated_maps lookup results. This setting requires that the table contains responses with both custom enhanced status code (X.Y.Z) and text. For details, see "man 5 relocated" or https://www.postfix.org/relocated.5.html . Major changes - requiretls [Feature 20241111] Support for the REQUIRETLS verb in SMTP. This, and everything that was added later through 2025, is described in REQUIRETLS_README. [Feature 20250120] After a certificate check fails, or a remote SMTP server does not announce REQUIRETLS support, the Postfix SMTP client will override the RFC 8689 5.x.x. status and treat it as a soft error, until there are no more alternate MX servers to try. [Feature 20250827] New parameter requiretls_redact_dsn (default: yes) to redact bounce messages as described in RFC 8689 section 5, so that they don't need REQUIRETLS support on every hop in the return path. [Feature 20250827] smtp_requiretls_policy and lmtp_requiretls_policy for responsible REQUIRETLS policy enforcement. REQUIRETLS must be enforced with care, because at this time most domains do not publish DANE or MTA-STS policies, and most MTAs and content filters do not support REQUIRETLS. [Feature 20250916] support for a "Require-TLS-ESMTP: yes" header to propagate an ESMTP REQUIRETLS request through a FILTER_README or SMTPD_PROXY_README style content filter. This header is detected or added by the cleanup daemon and by the before-proxy-filter Postfix SMTP server. This feature is enabled by default with "requiretls_esmtp_header = yes". The Require-TLS-ESMTP header will be visible to local and remote recipients. This feature can safely be disabled when a configuration does not use REQUIRETLS, or does not use FILTER_README or SMTPD_PROXY_README style content filters. Major changes - smtp server [Feature 20250801] smtpd_reject_filter_maps support to selectively replace a reject response from the Postfix SMTP server, or from a program that replies through the Postfix SMTP server. Major changes - smtputf8 [Feature 20250122] New Postfix sendmail command option "-O smtputf8" to request that deliveries over SMTP use the SMTPUTF8 extension. This reuses logic that was introduced for REQUIRETLS. [Feature 20250824] When a message needs to be delivered with SMTPUTF8, but a remote server does not support it, the Postfix SMTP client may now try alternate servers instead of returning the message immediately. This reuses code that was implemented for REQUIRETLS. Major changes - tls support [Feature 20250623] This changes the Postfix SMTP client smtp_tls_security_level default value to "may" if Postfix was built with TLS support, and the compatibility_level is 3.11 or higher. There is no change to the default lmtp_tls_security_level value. It remains empty, because there is no default TLS security level that makes sense for connections over UNIX-domain and loopback TCP and non-loopback TCP sockets. There also is no equivalent change for Postfix SMTP server TLS security levels, because changing smtpd_tls_security_level is not sufficient. Server-side TLS requires that at least one private key and corresponding public-key certificate chain are configured. [Feature 20251029] Debugging: depending on OpenSSL build options, "posttls-finger -L ssl-debug" will decode TLS handshake messages. [Feature 20251102] Post-quantum cryptography support: with OpenSSL 3.5 and later, change the tls_eecdh_auto_curves default value to avoid problems with network infrastructure that mis-handles TLS hello messages larger than one (Ethernet) TCP segment. This problem is more generally known as "protocol ossification". Major changes - tlsrpt [Incompat 20250601] the default smtp_tlsrpt_skip_reused_handshakes setting was changed from "yes" to "no". The new default is enabled with compatibility level >= 3.11. Signed-off-by: Adolf Belka Signed-off-by: Michael Tremer commit 3d084985cd6ce8359f760cc920ba545a0c2839de Author: Adolf Belka Date: Fri Aug 7 22:33:54 2026 +0200 core205: Ship pango Signed-off-by: Adolf Belka Signed-off-by: Michael Tremer commit 22d60f68d39c1e214511e08a1af980b62cc8222d Author: Adolf Belka Date: Fri Aug 7 22:34:05 2026 +0200 pango: Update to version 1.58.2 - Update from version 1.58.0 to 1.58.2 - Update of rootfile - Changelog 1.58.2 * No changes 1.58.1 * Require harfbuzz 11 * Require glib 2.88 * CoreText: Support variations * CoreText: Support font features from descriptions * Renderer: Keep over/under/through lines in sync * Fixes for undefined behavior Signed-off-by: Adolf Belka Signed-off-by: Michael Tremer commit 3f2ad2ac3801c35d2f2a0389092d727092086b5d Author: Adolf Belka Date: Fri Aug 7 22:34:04 2026 +0200 nut: Ship nut to pickup updated libusb from CU203 - In CU203 libusb was updated but nut was not shipped so for core updates it has stayed looking for libusb-1.0.so.0.5.0 but it should be looking for libusb-1.0.so.0.6.0 - This patch is intended to be merged into CU204 to bring existing nut installations up to date. Signed-off-by: Adolf Belka Signed-off-by: Michael Tremer commit 9d6bbad2f620d3058a16e58de8c1cef75bd410f7 Author: Adolf Belka Date: Fri Aug 7 22:34:03 2026 +0200 nfs: Update to version 2.9.2 - Update from version 2.9.1 to 2.9.2 - No change in rootfile - Changelog is just a list of the commits. The details can be found in the changelog at 2.9.2 https://sourceforge.net/projects/nfs/files/nfs-utils/2.9.2/ Signed-off-by: Adolf Belka Signed-off-by: Michael Tremer commit b6143f8c1065a54e850c140aad73b1062439ec05 Author: Adolf Belka Date: Fri Aug 7 22:34:02 2026 +0200 libtalloc: Update to version 2.5.0 - Update from version 2.4.4 to 2.5.0 - Update of rootfile - The last changelog recorded in the sourcde tarball is from 2007. The only place I have found anything is by filtering the samba gitlab mirror to show the commits related to talloc. 17 CVE fixes in the commits for 2.5.0 https://gitlab.com/samba-team/samba/-/commits/talloc-2.5.0?ref_type=tags Signed-off-by: Adolf Belka Signed-off-by: Michael Tremer commit 403a7f9c8c6b05c9369568d8f79da9ddb20ba059 Author: Adolf Belka Date: Fri Aug 7 22:33:53 2026 +0200 core205: Ship libarchive Signed-off-by: Adolf Belka Signed-off-by: Michael Tremer commit 9839fb681b1434fd8ac22921984d3474eb07f106 Author: Adolf Belka Date: Fri Aug 7 22:34:01 2026 +0200 libarchive: Update to version 3.8.9 - Update from version 3.8.8 to 3.8.9 - Update of rootfile - Changelog 3.8.9 There is no changelog. Changes are the individual commits between 3.8.8 and 3.8.9 https://github.com/libarchive/libarchive/compare/v3.8.8...v3.8.9 Signed-off-by: Adolf Belka Signed-off-by: Michael Tremer commit 53d845d812ab3f43c3ff5f3705acdced9d001e44 Author: Adolf Belka Date: Fri Aug 7 22:33:52 2026 +0200 core205: Ship hwdata Signed-off-by: Adolf Belka Signed-off-by: Michael Tremer commit 53ff7d74e65c376468e6b03d8792668568c6e997 Author: Adolf Belka Date: Fri Aug 7 22:34:00 2026 +0200 hwdata: Update to version 0.410 - Update from version 0.409 to 0.410 - No change to rootfile - Changelog 0.410 Update usb and vendor ids Signed-off-by: Adolf Belka Signed-off-by: Michael Tremer commit 8de1a761474d750ad638a13bd8db9519f63cabd4 Author: Adolf Belka Date: Fri Aug 7 22:33:51 2026 +0200 core205: Ship harfbuzz Signed-off-by: Adolf Belka Signed-off-by: Michael Tremer commit 699e136a59202d58714226749d7c8528826a744e Author: Adolf Belka Date: Fri Aug 7 22:33:59 2026 +0200 harfbuzz: Update to version 14.3.0 - Update from version 14.2.1 to 14.3.0 - Update of rootfile - Changelog 14.3.0 - Changes affecting shaping output: * Lookup order is now respected for mark positioning in the cross-direction (y in horizontal text, x in vertical text): marks no longer follow a cross-direction shift that a later lookup applies to the base. This improves compatibility with DirectWrite and Core Text. * Fix mark attachment to ligatures formed from decomposed glyphs. * The `calt` feature in Hangul text is now disabled only for the Jamos, not the whole buffer. - Support for partially instancing version of `avar` table, as well as `CFF2` table. - New fill-glyph paint operation and APIs for the common case of filling a glyph with a solid color. - New API to fetch assorted raw values from the `OS/2`, `head`, and `post` tables. - New experimental API to extract a font’s glyph dependency graph, that applications can use to compute glyph closures themselves without running the subsetter. - New subset flag to convert the charset of a subsetted CID-keyed `CFF` fonts into identity charset, and a matching `hb-subset` option. Useful for embedding fonts in PDF. - Command-line utilities now handle non-ASCII arguments correctly on Windows. - Various instancing and subsetting fixes. - Various fixes to the experimental `harfbuzz-vector`, `harfbuzz-raster` and `harfbuzz-gpu` libraries. - Various improvements to the HarfRust integration shaper. - Various build, CI, portability, and fuzzing fixes. - New API: * OpenType: +HB_OT_BITS_TAG_FS_TYPE +HB_OT_BITS_TAG_FS_SELECTION +HB_OT_BITS_TAG_MAC_STYLE +HB_OT_BITS_TAG_IS_FIXED_PITCH +HB_OT_BITS_TAG_UNICODE_RANGE_1 +HB_OT_BITS_TAG_UNICODE_RANGE_2 +HB_OT_BITS_TAG_UNICODE_RANGE_3 +HB_OT_BITS_TAG_UNICODE_RANGE_4 +HB_OT_BITS_TAG_CODE_PAGE_RANGE_1 +HB_OT_BITS_TAG_CODE_PAGE_RANGE_2 +HB_OT_NUMBER_TAG_FONT_X_MIN +HB_OT_NUMBER_TAG_FONT_Y_MIN +HB_OT_NUMBER_TAG_FONT_X_MAX +HB_OT_NUMBER_TAG_FONT_Y_MAX +hb_ot_bits_tag_t +hb_ot_fetch_bits() +hb_ot_number_tag_t +hb_ot_fetch_number() * Paint: +hb_paint_fill_glyph_func_t +hb_paint_fill_glyph() +hb_paint_funcs_set_fill_glyph_func() * Subset library: +HB_SUBSET_FLAGS_CFF_IDENTITY_CHARSET Signed-off-by: Adolf Belka Signed-off-by: Michael Tremer commit 025d72134b6d74e99833699728e52f2ea1ace3f7 Author: Adolf Belka Date: Fri Aug 7 22:33:50 2026 +0200 core205: Ship glib Signed-off-by: Adolf Belka Signed-off-by: Michael Tremer commit 835758bf4fc3488831cd3db396e69c76a9c5f97d Author: Adolf Belka Date: Fri Aug 7 22:33:58 2026 +0200 glib: Update to version 2.89.3 - Update from version 2.88.2 to 2.89.3 - Update of rootfile - Changelog 2.89.3 Support systemd-style UAPI file masking and drop-ins for GKeyFile (#3622 (closed), work by Stefan Schubert) Add some string and date convenience API, g_string_free_deep() and g_set_date_time() (!4919 (merged), !5193 (merged), work by Peter Eisenmann) Add some convenience API to GUnixFDList (!5233 (merged), work by Sebastian Wick) Bugs fixed: #3622 (closed) Support UAPI file masking and drop-ins in GKeyFile #3994 (closed) gio/tests: iptosmessage does not compile on Solaris #3999 (closed) fd leak in g_file_set_contents_full() on error? (Kondor Dániel) #4007 (closed) gio-tool: crash (assertion failed) when running 'gio help help' (Jose Carlos Leiva) !4919 (merged) Add g_string_free_deep !5193 (merged) datetime: Add g_set_date_time !5230 (merged) giostream: Clarify is_closed() method docs for streams !5233 (merged) gunixfdlist: Add g_unix_fd_list_append_take, g_unix_fd_list_peek, g_unix_fd_list_lookup, g_unix_fd_list_lookup_peek !5246 (merged) gtestutils: Fix a minor typo in a documentation comment !5248 (merged) tests: Minor compiler warning fixes for GCC16 !5249 (merged) build: Fix a deprecation warning from Meson 1.12 !5251 (merged) docs: Use dedicated docblocks for new enum members !5252 (merged) docs: Annotate callbacks rather than user_data !5254 (merged) Add finer accuracy g_timeout APIs !5255 (merged) gdbusnameowning: Don't print any logs when connection is closed !5257 (merged) Avoid reserved identifiers in public macros 2.89.2 Fix potential miscompilation with GCC 17 with G_GNUC_CONST on get_type() functions (#3984 (closed), work by Sam James) Update toolchain requirement to C11; previously this was just strongly recommended (!3574 (merged), work by Emmanuele Bassi) Bugs fixed: #2931 (closed) GMemoryMonitor should have a backend for systemd MEMORY_PRESSURE_WATCH API (Kate Hsuan) #3719 (closed) gspawn-win32-helper-console.exe fails on Windows with UNC path (Andrew Ziem) #3984 (closed) G_GNUC_CONST vs get_type comes home to roost (Sam James) #3985 (closed) Security report: GDBusServer pre-authentication DoS via unbounded SASL line buffering (Philip Withnall) #3986 (closed) GDBusActionGroupClass failure (Philip Withnall) !3574 (merged) Update toolchain requirement to C11 !5222 (merged) GNetworkMonitor: Stop pulling route table on sd-networkd hosts !5224 (merged) gquark: Fix an incorrect G_GNUC_CONST annotation on g_quark_to_string() !5226 (merged) fuzzing: Skip build if oss-fuzz and tests are both omitted !5232 (merged) gnetworkmonitornetlink: Performance improvements by following iproute2 behavior !5234 (merged) gmain: fix poll.h include order on AIX !5235 (merged) tests: Fix gi-inspect-typelib.py on Visual Studio !5236 (merged) gio/tests: skip unsupported IP TOS tests on AIX !5237 (merged) gdbus-serialization.c: Avoid g_autofree !5238 (merged) gpoll: Correctly zero-out heap-allocated fd_sets on macOS !5244 (merged) Update Romanian translation !5245 (merged) Update Slovenian translation !5247 (merged) gdbusnameowning: Downgrade ReleaseName warning on closed connection to debug Translation updates: Romanian (Antonio Marin) Slovenian (Martin) 2.89.1 Bugs fixed: #3972 (closed) g_thread_yield() may not yield control to another thread as expected on Linux. !5086 (merged) gio: gmemorymonitordbus: Fix fallback backends can't be properly loaded when... !5184 (merged) gregex: Remove "array length" annotations !5190 (merged) win32-build.md: Update Visual Studio build info !5191 (merged) Don't use slow content type for icons when only fast content is queried !5192 (merged) Update Romanian translation !5195 (merged) Update Slovenian translation !5196 (merged) Performance improvements to GVariant/GDBusMessage !5197 (merged) docs: fix wrong reference to gint16 for gint32 types in glib/types.md !5198 (merged) Add missing finish-func annotations !5199 (merged) gregex: g_match_info_fetch_pos() and g_match_info_fetch_all() will now work after partial matches as well !5200 (merged) gdatetime: Clarify docs around comparisons across time zones !5201 (merged) docs: GI annotation fixes for GCancellable !5202 (merged) Update Slovenian translation !5205 (merged) tests: Fix various leaks spotted by ASAN !5206 (merged) docs + tests: fix docs and add unit test about g_try_new with zero n_structs !5207 (merged) Update Romanian translation !5209 (merged) CI: Set msys2-clang64 as default job for merges !5210 (merged) docs: add missing reference to g_rc_box_new0 and g_atomic_rc_box_new0 and others in Reference Counting page !5211 (merged) gutf8: Eliminate redundant double-traversal in g_utf8_substring !5213 (merged) gsocket: Improve docs for g_socket_get_fd() !5214 (merged) gerror: Add missing introspection annotations !5216 (merged) Use dlopen to access environ on FreeBSD !5218 (merged) gvariant: Check for overflow in g_variant_new_fixed_array() !5221 (merged) meson: Override girepository-2.0 when glib is used as subproject Translation updates: Romanian (Antonio Marin) Slovenian (Martin) 2.89.0 Fix miscompilation with GCC 16 due to GLib’s use of the wrong function attribute (!5145 (merged), work by Sam James) Integrate better with the System Trash on macOS (#1161 (closed), work by Byoungchan Lee) Add g_set_strv(), g_set_strv_take() and g_set_str_take() convenience functions (#3907 (closed), !5118 (merged), work by Christian Hergert and Philip Withnall) Fix flag confusion security issue when using GRegex with G_REGEX_RAW which can result in unbounded out-of-bounds heap reads off the start of a regex input string (#3919 (closed), work by linhlhq) Fix various minor (low severity) security issues, typically one-to-five-byte out-of-bounds reads (#3915 (closed), #3916 (closed), #3917 (closed), #3918 (closed), #3930 (closed)) or ones relying on very specific (and unlikely) API calls (#3925 (closed)) or ones relying on discouraged P2P D-Bus configurations (#3931 (closed), #3933 (closed)) (work by linhlhq) Add support for GTypeInstance-derived types in generic marshaller (#3954 (closed), work by Christian Hergert) Change g_get_num_processors() to report number of performance cores, rather than number of performance+low-power cores on macOS (!5153 (merged), work by John Cupitt) Add support for XDG_PROJECTS_DIR special directory (!5141 (merged), work by Emmanuele Bassi and Jakub Steiner) Bugs fixed: 1161 (closed) g_file_trash() Files not moved to System Trash on Mac OSX 1853 (closed) DBus activated GApplications and G_APPLICATION_HANDLES_OPEN (Guido Günther) 2173 (closed) g_ascii_strtod() spec doesn't match C99/C11 standard for underflow behavior (depuc8) 3069 (closed) gio/trash test fails on macOS 3791 (closed) g_error causes -Wanalyzer-infinite-loop warnings in downstream code (correctmost) 3854 (closed) GRegex uses int for string length (Philip Withnall) 3907 (closed) Add g_set_strv() helper similar to g_set_str() (Christian Hergert) 3911 (closed) GMarkup chokes on BOM 3915 (closed) (#YWH-PGM9867-190) Buffer Over-read on GLib through glib/gvariant- serialiser.c:1253 via gvs_tuple_is_normal() (Philip Withnall) 3916 (closed) (#YWH-PGM9867-187) OOB Read on GLib through glib/gmarkup.c:g_markup_escape_text() via glib/gmarkup.c:append_escaped_text() (Philip Withnall) 3917 (closed) (#YWH-PGM9867-191) OOB Read on GLib through glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime (Philip Withnall) 3918 (closed) (#YWH-PGM9867-193) Buffer Over-read on GLib's g_regex_replace() through glib/gregex.c:string_append() via g_utf8_next_char() (Philip Withnall) 3919 (closed) (#YWH-PGM9867-194) Buffer Over-read on GLib through glib/gregex.c:g_regex_split_full() via glib/gutf8.c:g_utf8_prev_char() (Philip Withnall) 3925 (closed) (#YWH-PGM9867-199) Buffer Over-read on GLib through glib/giochannel.c via "g_io_channel_read_line_backend" (Philip Withnall) 3930 (closed) (#YWH-PGM9867-200) Off-by-one Error on GLib through glib/gkeyfile.c via "g_key_file_get_locale_string_list" (Philip Withnall) 3931 (closed) (#YWH-PGM9867-203) Path Traversal on GLib DBus through glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry, mechanism_client_data_receive (COOKIE_SHA1 Client Authentication) leads to Arbitrary File Read (Philip Withnall) 3932 (closed) (#YWH-PGM9867-204) Integer Underflow (CWE-191) on GLib through gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml" (Philip Withnall) 3933 (closed) Integer overflow in g_dbus_message_bytes_needed() bypasses 128 MiB size check (pre-auth DoS on P2P connections) (Philip Withnall) 3954 (closed) Generic marshaller lacks support for GTypeInstance derived types (Christian Hergert) 3958 (closed) FTBFS for vs2019-arm64 in libcharset due to undefined _CountOneBits64 !4990 (merged) gdbusauthmechanismsha1: Ignore G_DBUS_COOKIE_SHA1_KEYRING_DIR when suid !5094 (merged) gtestdbus: Keep config file around until bus daemon exits !5099 (merged) liststore: Micro-optimize no-op bulk operations !5101 (merged) Update Serbian translation !5102 (merged) g_base64_decode_step: fix documented type of in !5103 (merged) gdbusmessage: Documentation improvements !5105 (merged) docs: Expand docs for GLIB_VERSION_MAX_ALLOWED !5106 (merged) gmarkup: Add api to get attribute locations !5107 (merged) gmessages: Remove incorrect callback annotations !5110 (merged) gmarkup: fix type of length parameter of text_validate() !5111 (merged) Update Russian translation !5112 (merged) docs: Clarify default/user signal handlers !5113 (merged) Update Polish translation !5114 (merged) docs: Remove myself from CODEOWNERS !5115 (merged) build: Post-release version bump !5116 (merged) Update Slovenian translation !5117 (merged) fuzzing: Add a fuzz test for g_markup_escape_text() !5118 (merged) gstrfuncs: Add g_set_str_take() helper function !5119 (merged) tests: Check that g_markup_escape_text() returns something parseable !5120 (merged) Update Chinese (China) translation !5121 (merged) gio: Apply property accessor annotations to GDBus types !5123 (merged) Update Romanian translation !5124 (merged) gvariant: Tweak GVariantIter heap allocation casting !5125 (merged) gregex: Fix some missing Markdown formatting in docs !5126 (merged) Add missing annotations !5127 (merged) libffi: don't build testsuite when building as subproject !5128 (merged) gmarkup: Swap the argument order for g_realloc_n() !5136 (merged) docs: Clarify UTF-8 validity for functions which accept a length !5138 (merged) Update Slovenian translation !5140 (merged) Update Romanian translation !5141 (merged) Support XDG_PROJECTS_DIR !5142 (merged) gsocketconnection: Fix annotations for get_socket() !5145 (merged) gvarianttype: use pure attribute, not inappropriate const !5146 (merged) gmessages: Add missing stdlib.h include for abort() !5148 (merged) registrysettingsbackend: Chain up vfuncs !5149 (merged) gtype: Improve G_DEFINE and G_DECLARE docs !5153 (merged) g_get_num_processors(): on macOS, report n_pcore !5155 (merged) Update German translation !5157 (merged) Update Dutch translation !5158 (merged) gsocket: Fix g_socket_new_from_fd() on unbound sockets on windows !5159 (merged) gvariant: Tweak GVariantIter heap allocation size !5161 (merged) [docs] Gio.MenuModel: Fix bulleted list !5162 (merged) gvariant: Match allocation size of g_slice_new to g_slice_free !5163 (merged) gvariant test: Fix a leak !5164 (merged) tests: Avoid undefined signed left-shift in bitlock test !5167 (merged) docs: Add docs for G_GNUC_FLAG_ENUM !5176 (merged) gnulib: Fix unused flags variable warning !5177 (merged) gio/tests/pollable.c: Fix test on FreeBSD !5180 (merged) meson: Add valgrind suppression file to VALGRIND_OPTS in devenv !5182 (merged) Meson: Don't hardcode FFI_STATIC_BUILD / G_INTL_STATIC_COMPILATION !5183 (merged) gio/tests/pollable.c: Conditionalize on FreeBSD version in the /dev/null test case !5185 (merged) gio/gdesktopappinfo: Add precondition assertions !5187 (merged) Add safety documentation regarding use of g_shell_quote() !5188 (merged) Improve performance of g_array_maybe_expand() Translation updates: Chinese (China) (luming zh) Dutch (Nathan Follens) German (Christian Kirbach) Polish (Victoria Niedzielska) Romanian (Antonio Marin) Russian (Artur S0) Serbian (Марко Костић) Slovenian (Martin) Signed-off-by: Adolf Belka Signed-off-by: Michael Tremer commit 8bc513e1cd04019ca67ff495105b0c2c3ce4ee68 Author: Matthias Fischer Date: Fri Aug 7 11:47:14 2026 +0200 boost: Update rootfile for x64_86 Signed-off-by: Matthias Fischer Signed-off-by: Michael Tremer commit cae2012285d39e45e05049d9df7e51c10212e9eb Author: Matthias Fischer Date: Fri Aug 7 11:45:18 2026 +0200 attr 2.6.0: Fix for rootfile Signed-off-by: Matthias Fischer Signed-off-by: Michael Tremer commit 9b09332d370de83d949b1ecaaaa4e6360f5c17c4 Author: Michael Tremer Date: Sat Aug 8 16:37:44 2026 +0000 core205: Ship dhcpcd Signed-off-by: Michael Tremer commit 9019d363927f58ffddbff64e9e6ce4dfb68331e7 Author: Matthias Fischer Date: Fri Aug 7 11:43:18 2026 +0200 dhcpcd: Update to 10.5.0 For details see: https://github.com/NetworkConfiguration/dhcpcd/releases/tag/v10.5.0 "What's Changed Add missing SPDX-License tags by @ColinMcInnes in #591 Format code with clang-format v19 by @rsmarples in #601 privsep: Change IPC to use SOCK_STREAM by @rsmarples in #604 BPF: Split OS specific code out into own files and add libpcap support by @rsmarples in #607 hooks: Escape interface names and use printf by @rsmarples in #610 Delete DHCPv6 IA FD from the loop before closing it by @rsmarples in #611 eloop: Use kqueue or epoll to wait for a fd to become ready by @rsmarples in #612 Darwin: Add initial support for macOS by @rsmarples in #613 Import latest pidfile from NetBSD by @rsmarples in #618 BPF: Improve headers by @rsmarples in #619 compat: Add support for getprogname(3) by @rsmarples in #620 route: Rework rt structure so sockaddrs are pointers by @rsmarples in #621 dhcp-common: Escape ifname for lease file by @rsmarples in #622 privsep: smaller buffer size without INET6 by @rsmarples in #623 script: add ifxname as the escaped string by @rsmarples in #624 time.h always pulls in struct timespec by @rsmarples in #625 route: Use HAVE_RT_MISSFILTER rather than a generic BSD define by @rsmarples in #626 privsep: Test defines for all ioctls by @rsmarples in #627 if: if_init inits the interface from the kernel by @rsmarples in #628 privsep: Add ps_root_gethostname by @rsmarples in #630 DHCP: Don't really expire the lease when testing by @rsmarples in #631 DHCP: Don't add a trailing : on vendor if no machine arch by @rsmarples in #633 privsep: guard setproctitle and only use compat on linux by @rsmarples in #634 options: Remove some const to fix compile warnings by @rsmarples in #635 privsep: Don't open PF_INET socket for each ioctl by @rsmarples in #640 sun: Enable building for privsep by @rsmarples in #639 script: Use correct buffer length variable by @craciunoiuc in #641 privsep: Remove PS_BUFLEN by @rsmarples in #642 privsep: Simplify readerror by @rsmarples in #643 timezone: disallow directory traversal by @rsmarples in #644 privsep: ps_root_readfile should return the real file size by @rsmarples in #645 linux: Ensure NLA data boundaries are valid by @rsmarples in #646 options: Fix userclass boundary by @rsmarples in #647 ND6: fix OOB reject mask for an undefined option. by @rsmarples in #648 DHCP6: Ensure IA_PD Prefix Lenth is valid by @rsmarples in #649 ND: Enforce require and reject policy by @rsmarples in #650 ARP: check we have enough to read the frame header by @rsmarples in #651 hooks: Quote assignment of compat vars correctly by @rsmarples in #652 udev: Ensure we have a subsystem, action and ifname by @rsmarples in #653 Fix CI build by @rsmarples in #654 DHCP: Santize messages from servers for output by @rsmarples in #655 ARP: Iterate over states safely as the cb could remove ours by @rsmarples in #656 privsep: Check data is terminated when a string by @rsmarples in #657 auth: clear keys with memset_explicit by @rsmarples in #658 auth: Ensure remaining dlen matches hash digest length by @rsmarples in #659 hooks: don't read past truncated ip6 address starting fe by @rsmarples in #660 ipv6: Only regen temp addrs with sufficent pltime by @rsmarples in #661 eloop: Improve timespecdiff by @rsmarples in #662 eloop: Fix compile warning where UTIME_MAX is a calculation by @rsmarples in #663 vsio: Allow zero length options by @rsmarples in #664 DHCP6: Fix configuring the suffix to delegated prefixes by @rsmarples in #665 IPv6: Fix numerous issues extending temporary address times by @rsmarples in #666 capsicum: Avoid some overflow issues in privsep sysctl by @rsmarples in #667 script: Fix buffer over and under flows in script_buftoenv by @rsmarples in #668 control: Avoid hangup in the recvdata path by @rsmarples in #669 IPv6ND: Free routeinfo when it expires by @rsmarples in #670 DHCPv6: Prefix exclude option can be 17 octets by @rsmarples in #671 DHCPv6: When deprecating addresses, restart on prefix deletions by @rsmarples in #672 IPv4: uset old_ia when adding an address causes early removal by @rsmarples in #673 dhcp: add configurable backoff parameters for DHCPv4 by @cjp256 in #593 options: Introdce policy groups by @rsmarples in #678 Build all the targets on macos by @rsmarples in #679 control: remove unprivileged socket by @rsmarples in #680 DHCP: deconfigure even when state is NULL or NONE by @rsmarples in #687" Signed-off-by: Matthias Fischer Signed-off-by: Michael Tremer commit 4e71436cf0bef562517b69174ecbeef7d9e30766 Author: Adolf Belka Date: Thu Aug 6 11:26:45 2026 +0200 perl: Update rootfile - The rootfile had Getopt/Long/Parser.pm commented out. A forum user tried the Testing branch already and found a message in the logs that was looking for that perl file Signed-off-by: Adolf Belka Signed-off-by: Michael Tremer ----------------------------------------------------------------------- Summary of changes: config/rootfiles/common/attr | 1 + config/rootfiles/common/glib | 16 +- config/rootfiles/common/harfbuzz | 16 +- config/rootfiles/common/libarchive | 2 +- config/rootfiles/common/pango | 6 +- config/rootfiles/common/perl | 2 +- config/rootfiles/common/rrdtool | 202 ++++++++++----------- config/rootfiles/common/shadow | 7 +- config/rootfiles/common/sqlite | 2 +- config/rootfiles/common/x86_64/boost | 18 ++ .../{oldcore/125 => core/205}/filelists/dhcpcd | 0 .../{oldcore/118 => core/205}/filelists/glib | 0 .../{oldcore/163 => core/205}/filelists/harfbuzz | 0 .../{oldcore/132 => core/205}/filelists/hwdata | 0 .../{oldcore/104 => core/205}/filelists/libarchive | 0 .../{oldcore/163 => core/205}/filelists/pango | 0 .../{oldcore/111 => core/205}/filelists/rrdtool | 0 .../{oldcore/104 => core/205}/filelists/shadow | 0 .../{oldcore/125 => core/205}/filelists/sqlite | 0 .../{oldcore/199 => core/205}/filelists/systemd | 0 .../{oldcore/125 => core/205}/filelists/xfsprogs | 0 config/rootfiles/packages/clamav | 2 +- config/rootfiles/packages/frr | 3 + config/rootfiles/packages/libtalloc | 2 +- lfs/clamav | 6 +- lfs/dhcpcd | 6 +- lfs/dnsdist | 25 ++- lfs/fort-validator | 8 +- lfs/frr | 6 +- lfs/glib | 4 +- lfs/haproxy | 8 +- lfs/harfbuzz | 4 +- lfs/hwdata | 4 +- lfs/libarchive | 4 +- lfs/libtalloc | 6 +- lfs/nfs | 6 +- lfs/nut | 2 +- lfs/pango | 4 +- lfs/postfix | 6 +- lfs/rrdtool | 4 +- lfs/samba | 6 +- lfs/shadow | 10 +- lfs/sqlite | 4 +- lfs/systemd | 4 +- lfs/tcpdump | 8 +- lfs/xfsprogs | 4 +- .../shadow-4.20.0_Add_stdint.h_for_uintmax_t.patch | 22 +++ 47 files changed, 242 insertions(+), 198 deletions(-) copy config/rootfiles/{oldcore/125 => core/205}/filelists/dhcpcd (100%) copy config/rootfiles/{oldcore/118 => core/205}/filelists/glib (100%) copy config/rootfiles/{oldcore/163 => core/205}/filelists/harfbuzz (100%) copy config/rootfiles/{oldcore/132 => core/205}/filelists/hwdata (100%) copy config/rootfiles/{oldcore/104 => core/205}/filelists/libarchive (100%) copy config/rootfiles/{oldcore/163 => core/205}/filelists/pango (100%) copy config/rootfiles/{oldcore/111 => core/205}/filelists/rrdtool (100%) copy config/rootfiles/{oldcore/104 => core/205}/filelists/shadow (100%) copy config/rootfiles/{oldcore/125 => core/205}/filelists/sqlite (100%) copy config/rootfiles/{oldcore/199 => core/205}/filelists/systemd (100%) copy config/rootfiles/{oldcore/125 => core/205}/filelists/xfsprogs (100%) create mode 100644 src/patches/shadow-4.20.0_Add_stdint.h_for_uintmax_t.patch Difference in files: diff --git a/config/rootfiles/common/attr b/config/rootfiles/common/attr index 4307e1dd0..41a92d4a7 100644 --- a/config/rootfiles/common/attr +++ b/config/rootfiles/common/attr @@ -1,6 +1,7 @@ usr/bin/attr usr/bin/getfattr usr/bin/setfattr +#usr/etc #usr/etc/xattr.conf #usr/include/attr #usr/include/attr/attributes.h diff --git a/config/rootfiles/common/glib b/config/rootfiles/common/glib index fd92e25ff..8e76bdc60 100644 --- a/config/rootfiles/common/glib +++ b/config/rootfiles/common/glib @@ -339,22 +339,22 @@ usr/include/glib-2.0/gio/gdebugcontroller.h #usr/lib/glib-2.0/include/glibconfig.h #usr/lib/libgio-2.0.so usr/lib/libgio-2.0.so.0 -usr/lib/libgio-2.0.so.0.8800.2 +usr/lib/libgio-2.0.so.0.8903.0 #usr/lib/libgirepository-2.0.so usr/lib/libgirepository-2.0.so.0 -usr/lib/libgirepository-2.0.so.0.8800.2 +usr/lib/libgirepository-2.0.so.0.8903.0 #usr/lib/libglib-2.0.so usr/lib/libglib-2.0.so.0 -usr/lib/libglib-2.0.so.0.8800.2 +usr/lib/libglib-2.0.so.0.8903.0 #usr/lib/libgmodule-2.0.so usr/lib/libgmodule-2.0.so.0 -usr/lib/libgmodule-2.0.so.0.8800.2 +usr/lib/libgmodule-2.0.so.0.8903.0 #usr/lib/libgobject-2.0.so usr/lib/libgobject-2.0.so.0 -usr/lib/libgobject-2.0.so.0.8800.2 +usr/lib/libgobject-2.0.so.0.8903.0 #usr/lib/libgthread-2.0.so usr/lib/libgthread-2.0.so.0 -usr/lib/libgthread-2.0.so.0.8800.2 +usr/lib/libgthread-2.0.so.0.8903.0 #usr/lib/pkgconfig/gio-2.0.pc #usr/lib/pkgconfig/gio-unix-2.0.pc #usr/lib/pkgconfig/girepository-2.0.pc @@ -377,8 +377,8 @@ usr/lib/libgthread-2.0.so.0.8800.2 #usr/share/gdb/auto-load #usr/share/gdb/auto-load/usr #usr/share/gdb/auto-load/usr/lib -#usr/share/gdb/auto-load/usr/lib/libglib-2.0.so.0.8800.2-gdb.py -#usr/share/gdb/auto-load/usr/lib/libgobject-2.0.so.0.8800.2-gdb.py +#usr/share/gdb/auto-load/usr/lib/libglib-2.0.so.0.8903.0-gdb.py +#usr/share/gdb/auto-load/usr/lib/libgobject-2.0.so.0.8903.0-gdb.py #usr/share/gettext/its #usr/share/gettext/its/gschema.its #usr/share/gettext/its/gschema.loc diff --git a/config/rootfiles/common/harfbuzz b/config/rootfiles/common/harfbuzz index 2dd6c0134..abba2c36d 100644 --- a/config/rootfiles/common/harfbuzz +++ b/config/rootfiles/common/harfbuzz @@ -26,6 +26,7 @@ #usr/include/harfbuzz/hb-map.h #usr/include/harfbuzz/hb-ot-color.h #usr/include/harfbuzz/hb-ot-deprecated.h +#usr/include/harfbuzz/hb-ot-fetch.h #usr/include/harfbuzz/hb-ot-font.h #usr/include/harfbuzz/hb-ot-layout.h #usr/include/harfbuzz/hb-ot-math.h @@ -42,6 +43,7 @@ usr/include/harfbuzz/hb-script-list.h #usr/include/harfbuzz/hb-shape-plan.h #usr/include/harfbuzz/hb-shape.h #usr/include/harfbuzz/hb-style.h +#usr/include/harfbuzz/hb-subset-depend.h #usr/include/harfbuzz/hb-subset-serialize.h #usr/include/harfbuzz/hb-subset.h #usr/include/harfbuzz/hb-unicode.h @@ -52,25 +54,25 @@ usr/include/harfbuzz/hb-script-list.h #usr/lib/cmake/harfbuzz/harfbuzz-config.cmake #usr/lib/libharfbuzz-cairo.so usr/lib/libharfbuzz-cairo.so.0 -usr/lib/libharfbuzz-cairo.so.0.61421.0 +usr/lib/libharfbuzz-cairo.so.0.61430.0 #usr/lib/libharfbuzz-gobject.so usr/lib/libharfbuzz-gobject.so.0 -usr/lib/libharfbuzz-gobject.so.0.61421.0 +usr/lib/libharfbuzz-gobject.so.0.61430.0 #usr/lib/libharfbuzz-gpu.so usr/lib/libharfbuzz-gpu.so.0 -usr/lib/libharfbuzz-gpu.so.0.61421.0 +usr/lib/libharfbuzz-gpu.so.0.61430.0 #usr/lib/libharfbuzz-raster.so usr/lib/libharfbuzz-raster.so.0 -usr/lib/libharfbuzz-raster.so.0.61421.0 +usr/lib/libharfbuzz-raster.so.0.61430.0 #usr/lib/libharfbuzz-subset.so usr/lib/libharfbuzz-subset.so.0 -usr/lib/libharfbuzz-subset.so.0.61421.0 +usr/lib/libharfbuzz-subset.so.0.61430.0 #usr/lib/libharfbuzz-vector.so usr/lib/libharfbuzz-vector.so.0 -usr/lib/libharfbuzz-vector.so.0.61421.0 +usr/lib/libharfbuzz-vector.so.0.61430.0 #usr/lib/libharfbuzz.so usr/lib/libharfbuzz.so.0 -usr/lib/libharfbuzz.so.0.61421.0 +usr/lib/libharfbuzz.so.0.61430.0 #usr/lib/pkgconfig/harfbuzz-cairo.pc #usr/lib/pkgconfig/harfbuzz-gobject.pc #usr/lib/pkgconfig/harfbuzz-gpu.pc diff --git a/config/rootfiles/common/libarchive b/config/rootfiles/common/libarchive index 0b636a186..f7dc116f0 100644 --- a/config/rootfiles/common/libarchive +++ b/config/rootfiles/common/libarchive @@ -7,7 +7,7 @@ #usr/lib/libarchive.la #usr/lib/libarchive.so usr/lib/libarchive.so.13 -usr/lib/libarchive.so.13.8.8 +usr/lib/libarchive.so.13.8.9 #usr/lib/pkgconfig/libarchive.pc #usr/share/man/man1/bsdcat.1 #usr/share/man/man1/bsdcpio.1 diff --git a/config/rootfiles/common/pango b/config/rootfiles/common/pango index 53f3d6b9d..66a7f3394 100644 --- a/config/rootfiles/common/pango +++ b/config/rootfiles/common/pango @@ -41,13 +41,13 @@ usr/bin/pango-view #usr/include/pango-1.0/pango/pangoft2.h #usr/lib/libpango-1.0.so usr/lib/libpango-1.0.so.0 -usr/lib/libpango-1.0.so.0.5800.0 +usr/lib/libpango-1.0.so.0.5800.2 #usr/lib/libpangocairo-1.0.so usr/lib/libpangocairo-1.0.so.0 -usr/lib/libpangocairo-1.0.so.0.5800.0 +usr/lib/libpangocairo-1.0.so.0.5800.2 #usr/lib/libpangoft2-1.0.so usr/lib/libpangoft2-1.0.so.0 -usr/lib/libpangoft2-1.0.so.0.5800.0 +usr/lib/libpangoft2-1.0.so.0.5800.2 #usr/lib/pkgconfig/pango.pc #usr/lib/pkgconfig/pangocairo.pc #usr/lib/pkgconfig/pangofc.pc diff --git a/config/rootfiles/common/perl b/config/rootfiles/common/perl index 61a0a2ddc..1e617269e 100644 --- a/config/rootfiles/common/perl +++ b/config/rootfiles/common/perl @@ -264,7 +264,7 @@ usr/lib/perl5/5.42.2/FindBin.pm #usr/lib/perl5/5.42.2/Getopt #usr/lib/perl5/5.42.2/Getopt/Long usr/lib/perl5/5.42.2/Getopt/Long.pm -#usr/lib/perl5/5.42.2/Getopt/Long/Parser.pm +usr/lib/perl5/5.42.2/Getopt/Long/Parser.pm usr/lib/perl5/5.42.2/Getopt/Std.pm #usr/lib/perl5/5.42.2/HTTP usr/lib/perl5/5.42.2/HTTP/Tiny.pm diff --git a/config/rootfiles/common/rrdtool b/config/rootfiles/common/rrdtool index 628e3a777..140fb9899 100644 --- a/config/rootfiles/common/rrdtool +++ b/config/rootfiles/common/rrdtool @@ -33,107 +33,107 @@ usr/lib/perl5/site_perl/5.42.2/xxxMACHINExxx-linux-thread-multi/auto/RRDs/RRDs.s #usr/lib/python3/site-packages/rrdtool-0.1.10.dist-info/licenses/COPYING #usr/lib/python3/site-packages/rrdtool-0.1.10.dist-info/top_level.txt #usr/lib/python3/site-packages/rrdtool.cpython-310-xxxMACHINExxx-linux-gnu.so -#usr/share/doc/rrdtool-1.10.3 -#usr/share/doc/rrdtool-1.10.3/html -#usr/share/doc/rrdtool-1.10.3/html/RRDp.html -#usr/share/doc/rrdtool-1.10.3/html/RRDs.html -#usr/share/doc/rrdtool-1.10.3/html/bin_dec_hex.html -#usr/share/doc/rrdtool-1.10.3/html/cdeftutorial.html -#usr/share/doc/rrdtool-1.10.3/html/index.html -#usr/share/doc/rrdtool-1.10.3/html/librrd.html -#usr/share/doc/rrdtool-1.10.3/html/rpntutorial.html -#usr/share/doc/rrdtool-1.10.3/html/rrd-beginners.html -#usr/share/doc/rrdtool-1.10.3/html/rrd_pdpcalc.html -#usr/share/doc/rrdtool-1.10.3/html/rrdbuild.html -#usr/share/doc/rrdtool-1.10.3/html/rrdcached.html -#usr/share/doc/rrdtool-1.10.3/html/rrdcgi.html -#usr/share/doc/rrdtool-1.10.3/html/rrdcreate.html -#usr/share/doc/rrdtool-1.10.3/html/rrddump.html -#usr/share/doc/rrdtool-1.10.3/html/rrdfetch.html -#usr/share/doc/rrdtool-1.10.3/html/rrdfirst.html -#usr/share/doc/rrdtool-1.10.3/html/rrdflushcached.html -#usr/share/doc/rrdtool-1.10.3/html/rrdgraph.html -#usr/share/doc/rrdtool-1.10.3/html/rrdgraph_data.html -#usr/share/doc/rrdtool-1.10.3/html/rrdgraph_examples.html -#usr/share/doc/rrdtool-1.10.3/html/rrdgraph_graph.html -#usr/share/doc/rrdtool-1.10.3/html/rrdgraph_rpn.html -#usr/share/doc/rrdtool-1.10.3/html/rrdinfo.html -#usr/share/doc/rrdtool-1.10.3/html/rrdlast.html -#usr/share/doc/rrdtool-1.10.3/html/rrdlastupdate.html -#usr/share/doc/rrdtool-1.10.3/html/rrdlist.html -#usr/share/doc/rrdtool-1.10.3/html/rrdpython.html -#usr/share/doc/rrdtool-1.10.3/html/rrdresize.html -#usr/share/doc/rrdtool-1.10.3/html/rrdrestore.html -#usr/share/doc/rrdtool-1.10.3/html/rrdthreads.html -#usr/share/doc/rrdtool-1.10.3/html/rrdtool.html -#usr/share/doc/rrdtool-1.10.3/html/rrdtune.html -#usr/share/doc/rrdtool-1.10.3/html/rrdtutorial.html -#usr/share/doc/rrdtool-1.10.3/html/rrdupdate.html -#usr/share/doc/rrdtool-1.10.3/html/rrdxport.html -#usr/share/doc/rrdtool-1.10.3/txt -#usr/share/doc/rrdtool-1.10.3/txt/bin_dec_hex.pod -#usr/share/doc/rrdtool-1.10.3/txt/bin_dec_hex.txt -#usr/share/doc/rrdtool-1.10.3/txt/cdeftutorial.pod -#usr/share/doc/rrdtool-1.10.3/txt/cdeftutorial.txt -#usr/share/doc/rrdtool-1.10.3/txt/librrd.txt -#usr/share/doc/rrdtool-1.10.3/txt/rpntutorial.pod -#usr/share/doc/rrdtool-1.10.3/txt/rpntutorial.txt -#usr/share/doc/rrdtool-1.10.3/txt/rrd-beginners.pod -#usr/share/doc/rrdtool-1.10.3/txt/rrd-beginners.txt -#usr/share/doc/rrdtool-1.10.3/txt/rrd_pdpcalc.pod -#usr/share/doc/rrdtool-1.10.3/txt/rrd_pdpcalc.txt -#usr/share/doc/rrdtool-1.10.3/txt/rrdbuild.pod -#usr/share/doc/rrdtool-1.10.3/txt/rrdbuild.txt -#usr/share/doc/rrdtool-1.10.3/txt/rrdcached.pod -#usr/share/doc/rrdtool-1.10.3/txt/rrdcached.txt -#usr/share/doc/rrdtool-1.10.3/txt/rrdcgi.pod -#usr/share/doc/rrdtool-1.10.3/txt/rrdcgi.txt -#usr/share/doc/rrdtool-1.10.3/txt/rrdcreate.pod -#usr/share/doc/rrdtool-1.10.3/txt/rrdcreate.txt -#usr/share/doc/rrdtool-1.10.3/txt/rrddump.pod -#usr/share/doc/rrdtool-1.10.3/txt/rrddump.txt -#usr/share/doc/rrdtool-1.10.3/txt/rrdfetch.pod -#usr/share/doc/rrdtool-1.10.3/txt/rrdfetch.txt -#usr/share/doc/rrdtool-1.10.3/txt/rrdfirst.pod -#usr/share/doc/rrdtool-1.10.3/txt/rrdfirst.txt -#usr/share/doc/rrdtool-1.10.3/txt/rrdflushcached.pod -#usr/share/doc/rrdtool-1.10.3/txt/rrdflushcached.txt -#usr/share/doc/rrdtool-1.10.3/txt/rrdgraph.pod -#usr/share/doc/rrdtool-1.10.3/txt/rrdgraph.txt -#usr/share/doc/rrdtool-1.10.3/txt/rrdgraph_data.pod -#usr/share/doc/rrdtool-1.10.3/txt/rrdgraph_data.txt -#usr/share/doc/rrdtool-1.10.3/txt/rrdgraph_examples.pod -#usr/share/doc/rrdtool-1.10.3/txt/rrdgraph_examples.txt -#usr/share/doc/rrdtool-1.10.3/txt/rrdgraph_graph.pod -#usr/share/doc/rrdtool-1.10.3/txt/rrdgraph_graph.txt -#usr/share/doc/rrdtool-1.10.3/txt/rrdgraph_rpn.pod -#usr/share/doc/rrdtool-1.10.3/txt/rrdgraph_rpn.txt -#usr/share/doc/rrdtool-1.10.3/txt/rrdinfo.pod -#usr/share/doc/rrdtool-1.10.3/txt/rrdinfo.txt -#usr/share/doc/rrdtool-1.10.3/txt/rrdlast.pod -#usr/share/doc/rrdtool-1.10.3/txt/rrdlast.txt -#usr/share/doc/rrdtool-1.10.3/txt/rrdlastupdate.pod -#usr/share/doc/rrdtool-1.10.3/txt/rrdlastupdate.txt -#usr/share/doc/rrdtool-1.10.3/txt/rrdlist.pod -#usr/share/doc/rrdtool-1.10.3/txt/rrdlist.txt -#usr/share/doc/rrdtool-1.10.3/txt/rrdpython.pod -#usr/share/doc/rrdtool-1.10.3/txt/rrdpython.txt -#usr/share/doc/rrdtool-1.10.3/txt/rrdresize.pod -#usr/share/doc/rrdtool-1.10.3/txt/rrdresize.txt -#usr/share/doc/rrdtool-1.10.3/txt/rrdrestore.pod -#usr/share/doc/rrdtool-1.10.3/txt/rrdrestore.txt -#usr/share/doc/rrdtool-1.10.3/txt/rrdthreads.pod -#usr/share/doc/rrdtool-1.10.3/txt/rrdthreads.txt -#usr/share/doc/rrdtool-1.10.3/txt/rrdtool.pod -#usr/share/doc/rrdtool-1.10.3/txt/rrdtool.txt -#usr/share/doc/rrdtool-1.10.3/txt/rrdtune.pod -#usr/share/doc/rrdtool-1.10.3/txt/rrdtune.txt -#usr/share/doc/rrdtool-1.10.3/txt/rrdtutorial.pod -#usr/share/doc/rrdtool-1.10.3/txt/rrdtutorial.txt -#usr/share/doc/rrdtool-1.10.3/txt/rrdupdate.pod -#usr/share/doc/rrdtool-1.10.3/txt/rrdupdate.txt -#usr/share/doc/rrdtool-1.10.3/txt/rrdxport.pod -#usr/share/doc/rrdtool-1.10.3/txt/rrdxport.txt +#usr/share/doc/rrdtool-1.11.0 +#usr/share/doc/rrdtool-1.11.0/html +#usr/share/doc/rrdtool-1.11.0/html/RRDp.html +#usr/share/doc/rrdtool-1.11.0/html/RRDs.html +#usr/share/doc/rrdtool-1.11.0/html/bin_dec_hex.html +#usr/share/doc/rrdtool-1.11.0/html/cdeftutorial.html +#usr/share/doc/rrdtool-1.11.0/html/index.html +#usr/share/doc/rrdtool-1.11.0/html/librrd.html +#usr/share/doc/rrdtool-1.11.0/html/rpntutorial.html +#usr/share/doc/rrdtool-1.11.0/html/rrd-beginners.html +#usr/share/doc/rrdtool-1.11.0/html/rrd_pdpcalc.html +#usr/share/doc/rrdtool-1.11.0/html/rrdbuild.html +#usr/share/doc/rrdtool-1.11.0/html/rrdcached.html +#usr/share/doc/rrdtool-1.11.0/html/rrdcgi.html +#usr/share/doc/rrdtool-1.11.0/html/rrdcreate.html +#usr/share/doc/rrdtool-1.11.0/html/rrddump.html +#usr/share/doc/rrdtool-1.11.0/html/rrdfetch.html +#usr/share/doc/rrdtool-1.11.0/html/rrdfirst.html +#usr/share/doc/rrdtool-1.11.0/html/rrdflushcached.html +#usr/share/doc/rrdtool-1.11.0/html/rrdgraph.html +#usr/share/doc/rrdtool-1.11.0/html/rrdgraph_data.html +#usr/share/doc/rrdtool-1.11.0/html/rrdgraph_examples.html +#usr/share/doc/rrdtool-1.11.0/html/rrdgraph_graph.html +#usr/share/doc/rrdtool-1.11.0/html/rrdgraph_rpn.html +#usr/share/doc/rrdtool-1.11.0/html/rrdinfo.html +#usr/share/doc/rrdtool-1.11.0/html/rrdlast.html +#usr/share/doc/rrdtool-1.11.0/html/rrdlastupdate.html +#usr/share/doc/rrdtool-1.11.0/html/rrdlist.html +#usr/share/doc/rrdtool-1.11.0/html/rrdpython.html +#usr/share/doc/rrdtool-1.11.0/html/rrdresize.html +#usr/share/doc/rrdtool-1.11.0/html/rrdrestore.html +#usr/share/doc/rrdtool-1.11.0/html/rrdthreads.html +#usr/share/doc/rrdtool-1.11.0/html/rrdtool.html +#usr/share/doc/rrdtool-1.11.0/html/rrdtune.html +#usr/share/doc/rrdtool-1.11.0/html/rrdtutorial.html +#usr/share/doc/rrdtool-1.11.0/html/rrdupdate.html +#usr/share/doc/rrdtool-1.11.0/html/rrdxport.html +#usr/share/doc/rrdtool-1.11.0/txt +#usr/share/doc/rrdtool-1.11.0/txt/bin_dec_hex.pod +#usr/share/doc/rrdtool-1.11.0/txt/bin_dec_hex.txt +#usr/share/doc/rrdtool-1.11.0/txt/cdeftutorial.pod +#usr/share/doc/rrdtool-1.11.0/txt/cdeftutorial.txt +#usr/share/doc/rrdtool-1.11.0/txt/librrd.txt +#usr/share/doc/rrdtool-1.11.0/txt/rpntutorial.pod +#usr/share/doc/rrdtool-1.11.0/txt/rpntutorial.txt +#usr/share/doc/rrdtool-1.11.0/txt/rrd-beginners.pod +#usr/share/doc/rrdtool-1.11.0/txt/rrd-beginners.txt +#usr/share/doc/rrdtool-1.11.0/txt/rrd_pdpcalc.pod +#usr/share/doc/rrdtool-1.11.0/txt/rrd_pdpcalc.txt +#usr/share/doc/rrdtool-1.11.0/txt/rrdbuild.pod +#usr/share/doc/rrdtool-1.11.0/txt/rrdbuild.txt +#usr/share/doc/rrdtool-1.11.0/txt/rrdcached.pod +#usr/share/doc/rrdtool-1.11.0/txt/rrdcached.txt +#usr/share/doc/rrdtool-1.11.0/txt/rrdcgi.pod +#usr/share/doc/rrdtool-1.11.0/txt/rrdcgi.txt +#usr/share/doc/rrdtool-1.11.0/txt/rrdcreate.pod +#usr/share/doc/rrdtool-1.11.0/txt/rrdcreate.txt +#usr/share/doc/rrdtool-1.11.0/txt/rrddump.pod +#usr/share/doc/rrdtool-1.11.0/txt/rrddump.txt +#usr/share/doc/rrdtool-1.11.0/txt/rrdfetch.pod +#usr/share/doc/rrdtool-1.11.0/txt/rrdfetch.txt +#usr/share/doc/rrdtool-1.11.0/txt/rrdfirst.pod +#usr/share/doc/rrdtool-1.11.0/txt/rrdfirst.txt +#usr/share/doc/rrdtool-1.11.0/txt/rrdflushcached.pod +#usr/share/doc/rrdtool-1.11.0/txt/rrdflushcached.txt +#usr/share/doc/rrdtool-1.11.0/txt/rrdgraph.pod +#usr/share/doc/rrdtool-1.11.0/txt/rrdgraph.txt +#usr/share/doc/rrdtool-1.11.0/txt/rrdgraph_data.pod +#usr/share/doc/rrdtool-1.11.0/txt/rrdgraph_data.txt +#usr/share/doc/rrdtool-1.11.0/txt/rrdgraph_examples.pod +#usr/share/doc/rrdtool-1.11.0/txt/rrdgraph_examples.txt +#usr/share/doc/rrdtool-1.11.0/txt/rrdgraph_graph.pod +#usr/share/doc/rrdtool-1.11.0/txt/rrdgraph_graph.txt +#usr/share/doc/rrdtool-1.11.0/txt/rrdgraph_rpn.pod +#usr/share/doc/rrdtool-1.11.0/txt/rrdgraph_rpn.txt +#usr/share/doc/rrdtool-1.11.0/txt/rrdinfo.pod +#usr/share/doc/rrdtool-1.11.0/txt/rrdinfo.txt +#usr/share/doc/rrdtool-1.11.0/txt/rrdlast.pod +#usr/share/doc/rrdtool-1.11.0/txt/rrdlast.txt +#usr/share/doc/rrdtool-1.11.0/txt/rrdlastupdate.pod +#usr/share/doc/rrdtool-1.11.0/txt/rrdlastupdate.txt +#usr/share/doc/rrdtool-1.11.0/txt/rrdlist.pod +#usr/share/doc/rrdtool-1.11.0/txt/rrdlist.txt +#usr/share/doc/rrdtool-1.11.0/txt/rrdpython.pod +#usr/share/doc/rrdtool-1.11.0/txt/rrdpython.txt +#usr/share/doc/rrdtool-1.11.0/txt/rrdresize.pod +#usr/share/doc/rrdtool-1.11.0/txt/rrdresize.txt +#usr/share/doc/rrdtool-1.11.0/txt/rrdrestore.pod +#usr/share/doc/rrdtool-1.11.0/txt/rrdrestore.txt +#usr/share/doc/rrdtool-1.11.0/txt/rrdthreads.pod +#usr/share/doc/rrdtool-1.11.0/txt/rrdthreads.txt +#usr/share/doc/rrdtool-1.11.0/txt/rrdtool.pod +#usr/share/doc/rrdtool-1.11.0/txt/rrdtool.txt +#usr/share/doc/rrdtool-1.11.0/txt/rrdtune.pod +#usr/share/doc/rrdtool-1.11.0/txt/rrdtune.txt +#usr/share/doc/rrdtool-1.11.0/txt/rrdtutorial.pod +#usr/share/doc/rrdtool-1.11.0/txt/rrdtutorial.txt +#usr/share/doc/rrdtool-1.11.0/txt/rrdupdate.pod +#usr/share/doc/rrdtool-1.11.0/txt/rrdupdate.txt +#usr/share/doc/rrdtool-1.11.0/txt/rrdxport.pod +#usr/share/doc/rrdtool-1.11.0/txt/rrdxport.txt #usr/share/locale/fr/LC_MESSAGES/rrdtool.mo #usr/share/locale/hu/LC_MESSAGES/rrdtool.mo #usr/share/locale/ka/LC_MESSAGES/rrdtool.mo diff --git a/config/rootfiles/common/shadow b/config/rootfiles/common/shadow index d25da8957..170568306 100644 --- a/config/rootfiles/common/shadow +++ b/config/rootfiles/common/shadow @@ -11,13 +11,12 @@ etc/shadow #etc/shadow- #lib/libsubid.la #lib/libsubid.so -lib/libsubid.so.5 -lib/libsubid.so.5.0.0 +lib/libsubid.so.6 +lib/libsubid.so.6.0.0 sbin/nologin #usr/bin/chage #usr/bin/chfn #usr/bin/chsh -#usr/bin/expiry #usr/bin/faillog #usr/bin/gpasswd #usr/bin/newgidmap @@ -31,12 +30,10 @@ sbin/nologin usr/sbin/chpasswd usr/sbin/groupadd usr/sbin/groupdel -usr/sbin/groupmems usr/sbin/groupmod #usr/sbin/grpck usr/sbin/grpconv #usr/sbin/grpunconv -#usr/sbin/logoutd #usr/sbin/newusers #usr/sbin/pwck usr/sbin/pwconv diff --git a/config/rootfiles/common/sqlite b/config/rootfiles/common/sqlite index f12ed80ea..3b430d178 100644 --- a/config/rootfiles/common/sqlite +++ b/config/rootfiles/common/sqlite @@ -3,6 +3,6 @@ usr/bin/sqlite3 #usr/include/sqlite3ext.h usr/lib/libsqlite3.so usr/lib/libsqlite3.so.0 -usr/lib/libsqlite3.so.3.53.3 +usr/lib/libsqlite3.so.3.53.4 #usr/lib/pkgconfig/sqlite3.pc #usr/share/man/man1/sqlite3.1 diff --git a/config/rootfiles/common/x86_64/boost b/config/rootfiles/common/x86_64/boost index a10c5380d..6342c206a 100644 --- a/config/rootfiles/common/x86_64/boost +++ b/config/rootfiles/common/x86_64/boost @@ -17320,6 +17320,18 @@ #usr/lib/cmake/boost_chrono-1.90.0/boost_chrono-config-version.cmake #usr/lib/cmake/boost_chrono-1.90.0/boost_chrono-config.cmake #usr/lib/cmake/boost_chrono-1.90.0/libboost_chrono-variant-shared.cmake +#usr/lib/cmake/boost_cobalt-1.90.0 +#usr/lib/cmake/boost_cobalt-1.90.0/boost_cobalt-config-version.cmake +#usr/lib/cmake/boost_cobalt-1.90.0/boost_cobalt-config.cmake +#usr/lib/cmake/boost_cobalt-1.90.0/libboost_cobalt-variant-shared.cmake +#usr/lib/cmake/boost_cobalt_io-1.90.0 +#usr/lib/cmake/boost_cobalt_io-1.90.0/boost_cobalt_io-config-version.cmake +#usr/lib/cmake/boost_cobalt_io-1.90.0/boost_cobalt_io-config.cmake +#usr/lib/cmake/boost_cobalt_io-1.90.0/libboost_cobalt_io-variant-shared.cmake +#usr/lib/cmake/boost_cobalt_io_ssl-1.90.0 +#usr/lib/cmake/boost_cobalt_io_ssl-1.90.0/boost_cobalt_io_ssl-config-version.cmake +#usr/lib/cmake/boost_cobalt_io_ssl-1.90.0/boost_cobalt_io_ssl-config.cmake +#usr/lib/cmake/boost_cobalt_io_ssl-1.90.0/libboost_cobalt_io_ssl-variant-shared.cmake #usr/lib/cmake/boost_container-1.90.0 #usr/lib/cmake/boost_container-1.90.0/boost_container-config-version.cmake #usr/lib/cmake/boost_container-1.90.0/boost_container-config.cmake @@ -17482,6 +17494,12 @@ usr/lib/libboost_atomic.so.1.90.0 usr/lib/libboost_charconv.so.1.90.0 #usr/lib/libboost_chrono.so usr/lib/libboost_chrono.so.1.90.0 +#usr/lib/libboost_cobalt.so +usr/lib/libboost_cobalt.so.1.90.0 +#usr/lib/libboost_cobalt_io.so +usr/lib/libboost_cobalt_io.so.1.90.0 +#usr/lib/libboost_cobalt_io_ssl.so +usr/lib/libboost_cobalt_io_ssl.so.1.90.0 #usr/lib/libboost_container.so usr/lib/libboost_container.so.1.90.0 #usr/lib/libboost_context.so diff --git a/config/rootfiles/core/205/filelists/dhcpcd b/config/rootfiles/core/205/filelists/dhcpcd new file mode 120000 index 000000000..1e799dabb --- /dev/null +++ b/config/rootfiles/core/205/filelists/dhcpcd @@ -0,0 +1 @@ +../../../common/dhcpcd \ No newline at end of file diff --git a/config/rootfiles/core/205/filelists/glib b/config/rootfiles/core/205/filelists/glib new file mode 120000 index 000000000..44665746a --- /dev/null +++ b/config/rootfiles/core/205/filelists/glib @@ -0,0 +1 @@ +../../../common/glib \ No newline at end of file diff --git a/config/rootfiles/core/205/filelists/harfbuzz b/config/rootfiles/core/205/filelists/harfbuzz new file mode 120000 index 000000000..ffe1e0d0b --- /dev/null +++ b/config/rootfiles/core/205/filelists/harfbuzz @@ -0,0 +1 @@ +../../../common/harfbuzz \ No newline at end of file diff --git a/config/rootfiles/core/205/filelists/hwdata b/config/rootfiles/core/205/filelists/hwdata new file mode 120000 index 000000000..ced911666 --- /dev/null +++ b/config/rootfiles/core/205/filelists/hwdata @@ -0,0 +1 @@ +../../../common/hwdata \ No newline at end of file diff --git a/config/rootfiles/core/205/filelists/libarchive b/config/rootfiles/core/205/filelists/libarchive new file mode 120000 index 000000000..551f1f743 --- /dev/null +++ b/config/rootfiles/core/205/filelists/libarchive @@ -0,0 +1 @@ +../../../common/libarchive \ No newline at end of file diff --git a/config/rootfiles/core/205/filelists/pango b/config/rootfiles/core/205/filelists/pango new file mode 120000 index 000000000..6c37231c7 --- /dev/null +++ b/config/rootfiles/core/205/filelists/pango @@ -0,0 +1 @@ +../../../common/pango \ No newline at end of file diff --git a/config/rootfiles/core/205/filelists/rrdtool b/config/rootfiles/core/205/filelists/rrdtool new file mode 120000 index 000000000..7a82e414b --- /dev/null +++ b/config/rootfiles/core/205/filelists/rrdtool @@ -0,0 +1 @@ +../../../common/rrdtool \ No newline at end of file diff --git a/config/rootfiles/core/205/filelists/shadow b/config/rootfiles/core/205/filelists/shadow new file mode 120000 index 000000000..c0824b7b9 --- /dev/null +++ b/config/rootfiles/core/205/filelists/shadow @@ -0,0 +1 @@ +../../../common/shadow \ No newline at end of file diff --git a/config/rootfiles/core/205/filelists/sqlite b/config/rootfiles/core/205/filelists/sqlite new file mode 120000 index 000000000..4ea569766 --- /dev/null +++ b/config/rootfiles/core/205/filelists/sqlite @@ -0,0 +1 @@ +../../../common/sqlite \ No newline at end of file diff --git a/config/rootfiles/core/205/filelists/systemd b/config/rootfiles/core/205/filelists/systemd new file mode 120000 index 000000000..f5616415e --- /dev/null +++ b/config/rootfiles/core/205/filelists/systemd @@ -0,0 +1 @@ +../../../common/systemd \ No newline at end of file diff --git a/config/rootfiles/core/205/filelists/xfsprogs b/config/rootfiles/core/205/filelists/xfsprogs new file mode 120000 index 000000000..91032964d --- /dev/null +++ b/config/rootfiles/core/205/filelists/xfsprogs @@ -0,0 +1 @@ +../../../common/xfsprogs \ No newline at end of file diff --git a/config/rootfiles/packages/clamav b/config/rootfiles/packages/clamav index f17380c98..088ab0172 100644 --- a/config/rootfiles/packages/clamav +++ b/config/rootfiles/packages/clamav @@ -162,7 +162,7 @@ usr/sbin/clamd #usr/share/doc/ClamAV/html/mode-rust-2c9d5c9a.js #usr/share/doc/ClamAV/html/print.html #usr/share/doc/ClamAV/html/searcher-09f2665d.js -#usr/share/doc/ClamAV/html/searchindex-d348bbbb.js +#usr/share/doc/ClamAV/html/searchindex-f120d447.js #usr/share/doc/ClamAV/html/sitemap.xml #usr/share/doc/ClamAV/html/theme-dawn-4493f9c8.js #usr/share/doc/ClamAV/html/theme-tomorrow_night-9dbe62a9.js diff --git a/config/rootfiles/packages/frr b/config/rootfiles/packages/frr index 84a3753e6..cce3d9983 100644 --- a/config/rootfiles/packages/frr +++ b/config/rootfiles/packages/frr @@ -15,6 +15,7 @@ usr/bin/vtysh #usr/include/frr/lib/assert #usr/include/frr/lib/assert/assert.h #usr/include/frr/lib/atomlist.h +#usr/include/frr/lib/atomptr.h #usr/include/frr/lib/base64.h #usr/include/frr/lib/bfd.h #usr/include/frr/lib/bitfield.h @@ -184,6 +185,7 @@ usr/bin/vtysh #usr/include/frr/zebra/zebra_dplane.h #usr/include/frr/zebra/zebra_errors.h #usr/include/frr/zebra/zebra_evpn.h +#usr/include/frr/zebra/zebra_evpn_base.h #usr/include/frr/zebra/zebra_evpn_mac.h #usr/include/frr/zebra/zebra_evpn_mh.h #usr/include/frr/zebra/zebra_evpn_neigh.h @@ -303,6 +305,7 @@ usr/sbin/zebra #usr/share/yang/frr-route-types.yang #usr/share/yang/frr-routing.yang #usr/share/yang/frr-staticd.yang +#usr/share/yang/frr-test-config.yang #usr/share/yang/frr-test-module.yang #usr/share/yang/frr-vrf.yang #usr/share/yang/frr-vrrpd.yang diff --git a/config/rootfiles/packages/libtalloc b/config/rootfiles/packages/libtalloc index 97963ad2c..a5ffbb3ce 100644 --- a/config/rootfiles/packages/libtalloc +++ b/config/rootfiles/packages/libtalloc @@ -1,5 +1,5 @@ #usr/include/talloc.h #usr/lib/libtalloc.so usr/lib/libtalloc.so.2 -usr/lib/libtalloc.so.2.4.4 +usr/lib/libtalloc.so.2.5.0 #usr/lib/pkgconfig/talloc.pc diff --git a/lfs/clamav b/lfs/clamav index 5320f6986..4f12ab4f6 100644 --- a/lfs/clamav +++ b/lfs/clamav @@ -26,7 +26,7 @@ include Config SUMMARY = Antivirus Toolkit -VER = 1.5.3 +VER = 1.5.4 THISAPP = clamav-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = clamav -PAK_VER = 84 +PAK_VER = 85 DEPS = @@ -50,7 +50,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 1b2d42bc8c4fed29b71e10be9823da17f861a11e6a818654ae51b2b1fbd16619494572f9aa5e8712433bd65443c33f3e250baa99bb1fea031aa47c6bf6b81c21 +$(DL_FILE)_BLAKE2 = 9cd52cb4b885aae7b26477ed45efdd8cd12b5adae030a17db31cb0aa4489b004977b592e00c6d3121aae4367db842cf03c83f84eda06031537ed09051321be6e install : $(TARGET) diff --git a/lfs/dhcpcd b/lfs/dhcpcd index 6d15caad2..d4cade029 100644 --- a/lfs/dhcpcd +++ b/lfs/dhcpcd @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2025 IPFire Team # +# Copyright (C) 2007-2026 IPFire Team # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 10.2.4 +VER = 10.5.0 THISAPP = dhcpcd-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = cdc5c345c58f24852ecf7e6655446f9385c860d9095cca8fa40eaae27a1d05dfad667e1e39af6ace2bd73acaa799210d6345462c90a88f89839912416263fdef +$(DL_FILE)_BLAKE2 = 0b685acc78243b94f045fad33f10142e65c7883010e61a0f62f19c6ba080418dbf3ea939d7a22dd432ae6e9af8da90bd70da89d5e802ca481c797b03e1f41417 install : $(TARGET) diff --git a/lfs/dnsdist b/lfs/dnsdist index a65772a4a..ed1fb7430 100644 --- a/lfs/dnsdist +++ b/lfs/dnsdist @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2025 IPFire Team # +# Copyright (C) 2007-2026 IPFire Team # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -26,7 +26,7 @@ include Config SUMMARY = A highly DNS-, DoS- and abuse-aware loadbalancer -VER = 2.1.0 +VER = 2.1.1 THISAPP = dnsdist-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = dnsdist -PAK_VER = 36 +PAK_VER = 37 DEPS = @@ -50,7 +50,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = ae4abaea64f4ae0eb2615e649dd7f39997483d2376d063451d13c4089f6218b6d66dc206a5fae7a2245c6cddf392961047386b54bdbcaf90dd922a8c330e1034 +$(DL_FILE)_BLAKE2 = 88607ab943a22131b9e9f7321a5576ccda2d773637176cf72e04b0007dd4f812a806d6369bdcaf3f2f74e89c05988e7cf5b98886742fb927cd1b877243cc258b install : $(TARGET) @@ -84,15 +84,14 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) cd $(DIR_APP) && ./configure \ - --prefix=/usr \ - --sysconfdir=/etc \ - --with-libssl \ - --without-gnutls \ - --enable-dns-over-tls \ - --with-lua \ - --without-net-snmp \ - --disable-systemd - + --prefix=/usr \ + --sysconfdir=/etc \ + --with-libssl \ + --without-gnutls \ + --enable-dns-over-tls \ + --with-lua \ + --without-net-snmp \ + --disable-systemd cd $(DIR_APP) && make $(MAKETUNING) cd $(DIR_APP) && make install diff --git a/lfs/fort-validator b/lfs/fort-validator index b314fa34f..bbcf0153d 100644 --- a/lfs/fort-validator +++ b/lfs/fort-validator @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2025 IPFire Team # +# Copyright (C) 2007-2026 IPFire Team # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -26,7 +26,7 @@ include Config SUMMARY = Fort RPKI validator -VER = 1.6.7 +VER = 1.6.8 THISAPP = fort-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = fort-validator -PAK_VER = 2 +PAK_VER = 3 DEPS = rsync @@ -48,7 +48,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 95273f7fb8a7f57eee28e1dd2cef558f9bbae96106394651a1d092fa64c8953f55797c91a23c0c108133114699cb04fca2ae137795a3378ec03a2fc627e2efde +$(DL_FILE)_BLAKE2 = b40b300bd79cc9f481b55306e1e81f883814f992c0bc7334b8108a00b2b9141a1e6919f342e3945d809e32c912ec2e69b63acbfaa184b10d44ce7880139492dd install : $(TARGET) diff --git a/lfs/frr b/lfs/frr index 4757a8544..0188d5e8f 100644 --- a/lfs/frr +++ b/lfs/frr @@ -26,7 +26,7 @@ include Config SUMMARY = FRRouting Routing daemon -VER = 10.6.0 +VER = 10.7.0 THISAPP = frr-frr-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = frr -PAK_VER = 17 +PAK_VER = 18 DEPS = @@ -50,7 +50,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = ed90d54b832cb041cbc0e5bf833472ab2434b0b5fa0dfa89e56da6d6fae6cca272d6419b8004b1861469c4d2aeaee7d2858cfc148ec1d1313f5d41172fe46ead +$(DL_FILE)_BLAKE2 = 4adc266bb68788d084986ec5ada3aff2f8cee29203556340932930f8232b217ca649d126b982e03f8c7f82144ef6efed29eea2055d32d08cde242c52c6acca89 install : $(TARGET) diff --git a/lfs/glib b/lfs/glib index 20f79571e..0d814e654 100644 --- a/lfs/glib +++ b/lfs/glib @@ -24,7 +24,7 @@ include Config -VER = 2.88.2 +VER = 2.89.3 # https://download.gnome.org/sources/glib/ THISAPP = glib-$(VER) @@ -41,7 +41,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = fecce4ad82e62e429d30f4e9050a83b53715644fc8c7c89d767ecdaefa603530e81e024dd3450ce25bcd93b00fa6aeb8551b6240d3a04862dadeb895b0177e10 +$(DL_FILE)_BLAKE2 = 2a22ac4187a3a9d6955e38ec72fec00af2c4bf6d3cfcf74ec25e292f2f112da6065a8af6d4b538477fbcffb7d0bbb41272a8296922f99f7c2a61be9c4b9fe024 install : $(TARGET) diff --git a/lfs/haproxy b/lfs/haproxy index 8004ef479..030219275 100644 --- a/lfs/haproxy +++ b/lfs/haproxy @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2025 IPFire Team # +# Copyright (C) 2007-2026 IPFire Team # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -26,7 +26,7 @@ include Config SUMMARY = The Reliable, High Performance TCP/HTTP Load Balancer -VER = 3.4.2 +VER = 3.4.3 # From: https://www.haproxy.org/download/ @@ -36,7 +36,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = haproxy -PAK_VER = 35 +PAK_VER = 36 DEPS = @@ -54,7 +54,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = a6f5c1d84d2c0082fd40792edbf97477499703c062b58de794db874bcab9f62b2df792c3fbde88196f8c7412d0d5b8cbbe0e38197caa817cac071cad3bab1e9a +$(DL_FILE)_BLAKE2 = 75e8edf463e1e9a53a17aee51ef5995c800fe8e1bc043bb08aee55eb528b937f382f2488a8c7e155bbe5fad979c268cbc427d9317ef2bc9ac117940e7ac5bdd0 install : $(TARGET) diff --git a/lfs/harfbuzz b/lfs/harfbuzz index 1c4055a9b..e2de3e475 100644 --- a/lfs/harfbuzz +++ b/lfs/harfbuzz @@ -24,7 +24,7 @@ include Config -VER = 14.2.1 +VER = 14.3.0 THISAPP = harfbuzz-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 7dab5e69ea502a8b65e1a84c84796ce1afa5e369f3d705af3bbb884a116bf283a170a613831a5af2d28d5eea87360909335590c1a5f9d914088317041b5c01b4 +$(DL_FILE)_BLAKE2 = e4cce203054d98bae061f7baeee2a13f0e71138601f355d8e149296df6ac04f02edfa3bdf14daee2c5a723024caac28c677c09089061f9bb7dc3d179ca8a3e38 install : $(TARGET) diff --git a/lfs/hwdata b/lfs/hwdata index bf8447f9a..3e050e2c3 100644 --- a/lfs/hwdata +++ b/lfs/hwdata @@ -24,7 +24,7 @@ include Config -VER = 0.409 +VER = 0.410 THISAPP = hwdata-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -42,7 +42,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 49f9d31b7c0d16466e85b5af03d6457a4fd0d79769018d5440801efadb8fb55aa0dc978401141adafadc082b795f6da0f791e9b64c2766439b90e799b3ee7c10 +$(DL_FILE)_BLAKE2 = 5e02947999341b2e249097f76cf318a2aaca64aeca7620f3e510021c204d489f68f64c8dcefd830f4be9ad96fc3b602b78c76443396bbf53770d5315e89a5c5c install : $(TARGET) diff --git a/lfs/libarchive b/lfs/libarchive index 08c1ce689..e807477a5 100644 --- a/lfs/libarchive +++ b/lfs/libarchive @@ -24,7 +24,7 @@ include Config -VER = 3.8.8 +VER = 3.8.9 THISAPP = libarchive-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -41,7 +41,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = dc210097fbd6bf2db240699dc2ad9fc6030b4179ffc02fa1de96537eb59897d964470fb1a675c76bc0691aa2f138f5cb2479495ea904124c80297c7bd84effc6 +$(DL_FILE)_BLAKE2 = 4f3df81fa32231471b866a443d77069e74d25c5b806bccf9358b5e7df25e6626c882aafffbd22ff8fa6b78a009efd58827a75ce0169b0ed4a780f65968a799c7 install : $(TARGET) diff --git a/lfs/libtalloc b/lfs/libtalloc index b078acdee..b39856e9c 100644 --- a/lfs/libtalloc +++ b/lfs/libtalloc @@ -26,7 +26,7 @@ include Config SUMMARY = Samba talloc Library -VER = 2.4.4 +VER = 2.5.0 THISAPP = talloc-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = libtalloc -PAK_VER = 6 +PAK_VER = 7 DEPS = @@ -48,7 +48,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 6d30a6d81e516a3361a9bb7bd9d0a039b65dc774828a836fda0a9a2f9efa2006a136a8ccff0103b28c12daa9cf75bd4d8ee8b065f9559a93dd1d3cb1132f716a +$(DL_FILE)_BLAKE2 = 3f1af126fe16f129e061f825db43f60aa963073a1aaf31e0da946367a1accecf68fc33127484335ecea5ac8a2ebbedec172fee46bb2ad50da301924c5eb0bfd1 install : $(TARGET) diff --git a/lfs/nfs b/lfs/nfs index d0da3266b..06b91de29 100644 --- a/lfs/nfs +++ b/lfs/nfs @@ -26,7 +26,7 @@ include Config SUMMARY = Support Utilities for Kernel nfsd -VER = 2.9.1 +VER = 2.9.2 THISAPP = nfs-utils-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = nfs -PAK_VER = 30 +PAK_VER = 31 DEPS = rpcbind @@ -48,7 +48,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 029cc11c1d72c880aa22c90d841c7c9427e2acb2a39d46df07aac5714db62fad0dd78b82779fa325399cb03f4df918f0570bf17006b05efa3a9318f61000daab +$(DL_FILE)_BLAKE2 = ef6b726bdeda695047af9359316f4519e674b855b064feca409be97acc9e6f78585e4e064646f437b229fb5261b48618db33a458eb315228141b2e9693efd81b install : $(TARGET) diff --git a/lfs/nut b/lfs/nut index a86b1694f..a76fe147e 100644 --- a/lfs/nut +++ b/lfs/nut @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = nut -PAK_VER = 15 +PAK_VER = 16 DEPS = diff --git a/lfs/pango b/lfs/pango index df7a1277e..ebf0294a3 100644 --- a/lfs/pango +++ b/lfs/pango @@ -24,7 +24,7 @@ include Config -VER = 1.58.0 +VER = 1.58.2 # https://download.gnome.org/sources/pango/ THISAPP = pango-$(VER) @@ -41,7 +41,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = f8adae8198ac56d791ac9f5b95741f78826ff9cee3f67f831b838e5a6a3218f7fd9419a91c564eee7625ddbc1ec6ba0139e8870f3487c38aaa7123e155abcefd +$(DL_FILE)_BLAKE2 = 234ec97322322326c0e2cd134b35bc7c99bb6bc5f80500f864dc2047c6256f323f0d9cfe379915b31d4befb9419b98dbf7c54ddbf92407ca4c4a446673969616 install : $(TARGET) diff --git a/lfs/postfix b/lfs/postfix index 771588125..9584412ad 100644 --- a/lfs/postfix +++ b/lfs/postfix @@ -26,7 +26,7 @@ include Config SUMMARY = A fast, secure, and flexible mailer -VER = 3.11.4 +VER = 3.11.5 THISAPP = postfix-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = postfix -PAK_VER = 54 +PAK_VER = 55 DEPS = @@ -72,7 +72,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 7c41d43987949076d45507372cce748b6bd1a8a1407fa032ecaf91ab1ad086068e7920d43df0c8b8c47f415c8ccbeaeb7862470aa322f51176e197fbe941ca4f +$(DL_FILE)_BLAKE2 = c677014019ce0851e45b103e5d6a88972a10cd3685d4c68b47f6b94ee318b9e81fb017f5b15f4307f3b8c6719afcbba33f4fc1c31a4fb65fe040522d6af38704 install : $(TARGET) diff --git a/lfs/rrdtool b/lfs/rrdtool index c9c70c0cc..27db7b00b 100644 --- a/lfs/rrdtool +++ b/lfs/rrdtool @@ -24,7 +24,7 @@ include Config -VER = 1.10.3 +VER = 1.11.0 THISAPP = rrdtool-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 5ceacdeb3c653db27516f65ea1748bc1e50c1b4a44ec2bdfe4375e34807654eff29d0c14e350a2b95b1b59da61e159d5cbadfb5bedcd44ab0ce79ee250e41733 +$(DL_FILE)_BLAKE2 = 3c02df300dcd096aeccecf24b8331df5227d1ec5c24dfe3382357e8c1dc5ec66620e276b8834894c17200063788a6825c37936a716f7220bdc9169965519c964 install : $(TARGET) diff --git a/lfs/samba b/lfs/samba index 545faac50..c21e8bbc0 100644 --- a/lfs/samba +++ b/lfs/samba @@ -24,7 +24,7 @@ include Config -VER = 4.24.2 +VER = 4.24.5 SUMMARY = A SMB/CIFS File, Print, and Authentication Server THISAPP = samba-$(VER) @@ -33,7 +33,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = samba -PAK_VER = 122 +PAK_VER = 123 DEPS = avahi libtalloc perl-Parse-Yapp wsdd @@ -47,7 +47,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 464b9324b1c4d9e50d70c0d921c65b775f49db9e9b82314cc072ad03087f2d2f3ca4c9cf2925a3628c07c2f4664f58f9a36528078a14666d1fcb20ddb7949b44 +$(DL_FILE)_BLAKE2 = 4796e3ae5e70c1d11d9326566677f0909423c5aad140309bfd9b3f8a3dedefe49660d0a0d502a681726ed7a961779587c33c9da29ecf69664b00a2ca958e64af install : $(TARGET) diff --git a/lfs/shadow b/lfs/shadow index f0e23408a..f1a021910 100644 --- a/lfs/shadow +++ b/lfs/shadow @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2025 IPFire Team # +# Copyright (C) 2007-2026 IPFire Team # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 4.18.0 +VER = 4.20.0 THISAPP = shadow-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = f165f8cdf017ed5875fbea3ece01d44f988bc85ee039186b5cd8d5cb07d666d501065ad9746abf80c2d31661b0cc687a2bc375e286a5805fa168f6826724e82e +$(DL_FILE)_BLAKE2 = 8224edc692d6016da26e54aa43405029b4bebcbc7a73a9a56f1ee3bdcf7c7a3af6b90d8fc134182fc26c6b7b8f2afc4f54c2f6e6748760b8928284aa77374a15 install : $(TARGET) @@ -70,6 +70,7 @@ $(subst %,%_BLAKE2,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/shadow-4.20.0_Add_stdint.h_for_uintmax_t.patch cd $(DIR_APP) && find man -name Makefile.in -exec sed -i 's/getspnam\.3 / /' {} \; cd $(DIR_APP) && find man -name Makefile.in -exec sed -i 's/passwd\.5 / /' {} \; $(UPDATE_AUTOMAKE) @@ -84,7 +85,8 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) --with-group-name-max-length=32 \ --without-libbsd \ --without-bcrypt \ - --without-nscd + --without-nscd \ + --disable-logind cd $(DIR_APP) && make $(MAKETUNING) cd $(DIR_APP) && make install diff --git a/lfs/sqlite b/lfs/sqlite index 50e6e6525..6498e84be 100644 --- a/lfs/sqlite +++ b/lfs/sqlite @@ -24,7 +24,7 @@ include Config -VER = 3530300 +VER = 3530400 THISAPP = sqlite-autoconf-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 61ee1a88258fdfed02c51c9b0302a0eb27e58b90b5285be6e89753293f1662caa0a7d6de586bdfd72ddeffe166a0704702bed99040d2998674b22289718f3935 +$(DL_FILE)_BLAKE2 = 92fa9cf76fa8bba391e75ef2f0599f9730e945dfdff1e2b8031ea90a3e20853230c2981743b12676f21bb30b0b3e629748eef35af2a688ae1073b927b080f40b install : $(TARGET) diff --git a/lfs/systemd b/lfs/systemd index 446e397df..cba1b7620 100644 --- a/lfs/systemd +++ b/lfs/systemd @@ -24,7 +24,7 @@ include Config -VER = 261.1 +VER = 261.2 THISAPP = systemd-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -50,7 +50,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = ab345d6ae27d361aa56d3b021263e2b2e3af76cdc37ee9015932557f1b904f2e5e5a6d5911b4a442057d12d5eedf8a702a30aa13f9b68294ccc14833f397a0ea +$(DL_FILE)_BLAKE2 = f8f57c5e78ff31727ecfd18b61d3a3a95b764e5a049c0cc974be567273db2f771ab2f50df1ebf06b0c3a659c7e02db309dee4844217e3a91ae1169877971a34e install : $(TARGET) diff --git a/lfs/tcpdump b/lfs/tcpdump index 2ac5b19de..bff7d864a 100644 --- a/lfs/tcpdump +++ b/lfs/tcpdump @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2025 IPFire Team # +# Copyright (C) 2007-2026 IPFire Team # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -26,7 +26,7 @@ include Config SUMMARY = A Packet Sniffer -VER = 4.99.5 +VER = 4.99.6 THISAPP = tcpdump-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = tcpdump -PAK_VER = 17 +PAK_VER = 18 DEPS = @@ -48,7 +48,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 30b8e81e29f37f220ab9301185301190c5abb6ee8a8105c899e53e96b93265d3d408a181b75ee18bd70f96494c5dcf12374aedddd1db6fd7ab41e5c5ba35c7e5 +$(DL_FILE)_BLAKE2 = 2594accf903843641afe568e4563d94f649bcd23bcee3782024107d1868a9b7978a7130fd85a8846c7562472f10e3b0e5011067dc10e4c58dfcad96e7a353547 install : $(TARGET) diff --git a/lfs/xfsprogs b/lfs/xfsprogs index 0b30980dd..8d6653380 100644 --- a/lfs/xfsprogs +++ b/lfs/xfsprogs @@ -24,7 +24,7 @@ include Config -VER = 7.0.1 +VER = 7.1.1 # https://www.kernel.org/pub/linux/utils/fs/xfs/xfsprogs/ THISAPP = xfsprogs-$(VER) @@ -47,7 +47,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 0834beee30b6f4d6cf16c4e34d2daff0720d1f620d75f1794eb8c8f8d822768f48e8d6d51e51ec8c1eeb73a0e3123a8baa6647cf3215f9d25254cc13d6cf02ba +$(DL_FILE)_BLAKE2 = 7c3f6f4802cb32bb88cf9f439f73aeff4ebf495ff6928c0fe6da977c96256b7fa84e1f71c370ef3e1532a8534709acfc0d3c8e1d404543c6bb0f5c9a9235ba5a install : $(TARGET) diff --git a/src/patches/shadow-4.20.0_Add_stdint.h_for_uintmax_t.patch b/src/patches/shadow-4.20.0_Add_stdint.h_for_uintmax_t.patch new file mode 100644 index 000000000..e07e7db74 --- /dev/null +++ b/src/patches/shadow-4.20.0_Add_stdint.h_for_uintmax_t.patch @@ -0,0 +1,22 @@ +diff -Naur shadow-4.20.0.orig/lib/find_new_sub_gids.c shadow-4.20.0/lib/find_new_sub_gids.c +--- shadow-4.20.0.orig/lib/find_new_sub_gids.c 2026-08-07 18:55:36.246967805 +0200 ++++ shadow-4.20.0/lib/find_new_sub_gids.c 2026-08-07 22:41:35.771731696 +0200 +@@ -8,6 +8,7 @@ + + #ifdef ENABLE_SUBIDS + ++#include + #include + #include + +diff -Naur shadow-4.20.0.orig/lib/find_new_sub_uids.c shadow-4.20.0/lib/find_new_sub_uids.c +--- shadow-4.20.0.orig/lib/find_new_sub_uids.c 2026-08-07 18:56:37.619956630 +0200 ++++ shadow-4.20.0/lib/find_new_sub_uids.c 2026-08-07 22:41:52.640184987 +0200 +@@ -8,6 +8,7 @@ + + #ifdef ENABLE_SUBIDS + ++#include + #include + #include + hooks/post-receive -- IPFire 2.x development tree