packages/libs, branch master

srt: use ATOMIC64_DEPENDS

2026-09-16T15:35:19Z

libatomic is only needed where the compiler does not inline 64-bit atomics, but the package depends on it on every target. ATOMIC64_DEPENDS restricts the dependency to those targets. Signed-off-by: Daniel Golle

libopen62541: drop libatomic dependency

2026-09-16T15:35:19Z

The library links nothing from libatomic on any architecture, so the dependency is unnecessary. Signed-off-by: Daniel Golle

gnutls: drop libatomic dependency

2026-09-16T15:35:19Z

The libraries link nothing from libatomic on any architecture, so the dependency is unnecessary. Signed-off-by: Daniel Golle

libtorrent: stop discarding the target build flags

2026-09-15T17:08:12Z

CONFIGURE_VARS is assigned rather than appended to, which discards the default from package-defaults.mk: the cross compiler settings and the CFLAGS, CXXFLAGS, CPPFLAGS and LDFLAGS the build system passes. The library is configured with autoconf's own -g -O2 and built for the toolchain's default architecture instead, without the target CPU flags, the hardening flags and -ffile-prefix-map. On x86/geode that also costs the 64-bit atomics: at the default -march=i486 the compiler cannot inline them and emits __atomic_load_8 and __atomic_store_8 calls, so every binary linking the static library needs libatomic. Fixes: 13a058bed6c0 ("libtorrent: update to 0.15.3") Signed-off-by: Daniel Golle

expat: update to 2.8.4

2026-09-12T21:33:43Z

This version bump includes fixes for the following CVEs: - CVE-2026-66046 - CVE-2026-72522 - CVE-2026-76641 - CVE-2026-76956 - CVE-2026-76957 Full release notes: https://github.com/libexpat/libexpat/blob/master/expat/Changes Signed-off-by: Wei-Ting Yang

openldap: update to 2.6.14

2026-09-10T08:12:08Z

Changelog is available at: https://openldap.org/software/release/changes_lts.html Reworked some patches with headers to comply with patches guidelines. Signed-off-by: Romain Isnel

c-ares: bump to 1.34.8

2026-09-04T14:04:44Z

Update c-ares from 1.34.6 to 1.34.8. Version 1.34.7 includes the following security fixes: * CVE-2026-33630 (GHSA-6wfj-rwm7-3542): fix a use-after-free / double-free issue in query-completion handling. * CVE-2026-69184 (GHSA-pjmc-gx33-gc76): limit DNS name compression pointer traversal to prevent CPU-exhaustion denial of service. * CVE-2026-69186 (GHSA-jv8r-gqr9-68wj): validate DNS record counts before allocation to prevent memory-amplification denial of service. It also fixes the UDP socket exhaustion regression introduced in 1.34.6. Version 1.34.8 reverts an unintended API break introduced in 1.34.7 by the callback parameter const changes. Signed-off-by: Karen Khachatryan

libdht: update to 2026-09-01

2026-09-02T14:50:59Z

Two fixes to the maintenance and search timers, both of which cost a node contacts it should have had. Neighbourhood maintenance for both address families was gated on a single flag that either family's bucket maintenance could set. Bucket maintenance only confirms nodes that are already known, while neighbourhood maintenance is what grows the table, so a family whose nodes never answer held back table growth for the other family too. A node with no route for one family still holds addresses of that family, because they arrive in the replies of the other, so this reaches any single-stack node on a dual-stack build. Each family is now gated on its own bucket maintenance, and the number of queries per round is unchanged. A search step scheduled for exactly its due second returned without sending anything, because the comparison required the second to have passed rather than arrived. The early return left the step time alone, so the search then waited another full interval having sent nothing. Reset PKG_RELEASE, since the source version changed. Signed-off-by: Daniel Golle

libjuice: fix SHA-1 on big-endian targets

2026-09-01T00:17:38Z

libjuice's vendored picohash guards the final byte-order swap in _picohash_sha1_final with SHA_BIG_ENDIAN, which nothing defines, while endianness is detected into _PICOHASH_BIG_ENDIAN. On big-endian targets the swap runs when it must not and every SHA-1 digest is emitted with each 32-bit word reversed, taking HMAC-SHA1 with it. libjuice uses HMAC-SHA1 for STUN MESSAGE-INTEGRITY, so on mips, mips64, powerpc and every other big-endian target each ICE connectivity check is rejected as failing integrity. No candidate pair is nominated and no session can be established. picohash is the default backend, as USE_NETTLE is off, so this affects the package as built here. Verified on lantiq/xrx200 (mips_24kc, MIPS 34Kc): before the patch an ICE agent loops with "STUN integrity check failed" and never leaves the connecting state; after it the agent reaches completed and a session comes up over the DHT and ICE. RFC 2202 HMAC-SHA1 test case 1 and the SHA-1 vector for "abc" both fail before and pass after. Submitted upstream as paullouisageneau/libjuice#353 and, for the vendored copy's origin, kazuho/picohash#13. Signed-off-by: Daniel Golle

libssh: fix big-endian -R forwarding and crash without entropy source

2026-08-28T09:14:51Z

On big-endian hosts the server parsed every tcpip-forward bind port as zero and bound an ephemeral port, so -R remote forwarding never carried a connection. With no usable entropy source the library crashed inside mbedtls instead of failing cleanly. Patches 2-4 were sent upstream to the libssh mailing list: https://archive.libssh.org/libssh/2026-08/0000000.html https://archive.libssh.org/libssh/2026-08/0000001.html Patch 1 backports the seed-failure error path they depend on from upstream master commit ac4b723c. Signed-off-by: Daniel Golle