packages, branch master

gperftools: update to 2.19.2

2026-11-06T00:31:32Z

The three patches for PowerPC and musl are included upstream since 2.19. 2.19 adds the aw-backtrace stack trace engine. configure enables it only on x86_64 and aarch64 with _dl_find_object, which musl does not have, so musl targets keep the old code. libtcmalloc keeps the soname libtcmalloc.so.4, so ABI_VERSION stays. Release notes: https://github.com/gperftools/gperftools/releases/tag/gperftools-2.18 https://github.com/gperftools/gperftools/releases/tag/gperftools-2.18.1 https://github.com/gperftools/gperftools/releases/tag/gperftools-2.19 https://github.com/gperftools/gperftools/releases/tag/gperftools-2.19.1 https://github.com/gperftools/gperftools/releases/tag/gperftools-2.19.2 Signed-off-by: Josef Schlehofer

rust: update to 1.96.1

2026-11-05T20:08:35Z

This patch release brings libssh2 patches in cargo for CVE-2025-15661, CVE-2026-55199 and CVE-2026-55200, a fix for cargo's timeout and retry behavior, and a fix for a rustc miscompilation in a MIR optimization. LLVM and src/bootstrap are the same as in 1.96.0, so both patches apply unchanged. Changelog: - https://github.com/rust-lang/rust/releases/tag/1.96.1 Signed-off-by: Josef Schlehofer

openssh: update to 10.6_p2

2026-11-05T14:09:36Z

OpenSSH 10.6p2 works around a critical authentication bug. https://www.openssh.org/txt/release-10.6p2 Signed-off-by: Darren Tucker

shunt: update to 0.4.0

2026-11-05T13:13:45Z

Failover implemented: - interface takes an ordered list: new connections use the first interface that works and move to the next one when it goes down - netifd reports it down, or with track_ip it stops answering - and return when an earlier one works again; the fallback applies only when none works - every interface of a policy has a mark, a routing table and rules of its own, so running connections stay on the interface they started on and a return to the first interface resets nothing - gw4/gw6 apply to a policy with a single interface; with several they are reported and the gateways come from netifd - track_ip probes are keyed by the configured interface name and follow its device across interface events - an interface netifd reports down is handled as dead from the start, without route operations that cannot apply - ubus status reports the interface in use per policy, `shunt check` and the rpcd backend list a line per policy interface - update the README Co-authored-by: Claude Signed-off-by: Dirk Brenken

taglib: bump to 2.3.2

2026-11-05T11:55:46Z

Notable changes since 2.3.1: - verify values parsed from files to prevent resource exhaustion, denial of service and out-of-range conversions from crafted input (AIFF, APE, DSDIFF, FLAC, MP3, MP4, MPC, Matroska, Ogg, SHN, WMA, XM) - MP3: fix parsing of per-frame unsynchronized ID3v2 frames - MP4: support AC3, DTS, EAC3, FLAC and Opus codecs - RIFF: support RF64 and BW64 - fix data races in lazily initialized shared caches - use Requires.private for zlib in the pkg-config file Release notes: https://github.com/taglib/taglib/releases/tag/v2.3.2 Signed-off-by: Roberto Andrei Bolda

fuse3: bump to 3.18.3

2026-11-05T11:55:09Z

3.18.3 is a security release. Notable fixes since 3.18.2: - fusermount3: resolve the mountpoint once through an O_PATH|O_NOFOLLOW descriptor, so a symlink swapped in between the type check and the second lookup can no longer redirect the mount - fusermount3: run the auto-unmount probe as the calling user instead of opening a caller-supplied path with elevated privileges - mount_util: terminate the /bin/mount and /bin/umount argument vectors with "--" and skip the mtab update for option-like arguments - fuse_session_custom_io() is disabled unless libfuse is built with -Denable-custom-io=true Release notes: https://github.com/libfuse/libfuse/releases/tag/fuse-3.18.3 Signed-off-by: Roberto Andrei Bolda

nmap: add missing CONFLICTS between variants

2026-11-04T18:46:16Z

The ssl and full variants of nmap, ncat and nping install the same files as the plain ones, for example /usr/bin/nmap, /usr/bin/ncat and /usr/bin/nping. Nothing marks them as conflicting, so they can be selected and installed together. Declare the conflicts so that only one variant can be selected or installed. Checked the Conflicts field in the generated package metadata. Signed-off-by: Josef Schlehofer

libshout: let the other variants provide libshout

2026-11-04T18:45:56Z

libshout, libshout-nossl and libshout-full install the same library, but only libshout satisfies the packages that depend on libshout. Nothing marks them as conflicting either, so installing libshout-full for oggfwd next to libshout for mpd silently overwrites libshout.so.3. Let libshout-nossl and libshout-full provide libshout, make libshout the default variant and declare the conflicts. The conflicts sit on libshout and libshout-full, as packages depending on libshout select it depending on the other variants, and a conflict in the other direction creates a Kconfig dependency cycle. Checked the generated package metadata and Kconfig. Signed-off-by: Josef Schlehofer

pv: bump to 1.12.0

2026-11-04T18:45:46Z

Changes since 1.11.0: - new --format string %{progress-conemu} and option --conemu - eliminate potential closure of standard output under a combination of error conditions when using --monitor - Italian and Romanian translations added, Russian updated Changelog: https://codeberg.org/ivarch/pv (docs/NEWS.md, 1.12.0) Signed-off-by: Roberto Andrei Bolda

radicale3: bump to v3.9.0 (security)

2026-11-04T17:16:06Z

This is a security, bug fix, and feature release. See the release notes: https://github.com/Kozea/Radicale/releases/tag/v3.9.0 Signed-off-by: Daniel F. Dickinson