packages/multimedia, branch master

yt-dlp: bump to 2026.07.04

2026-07-16T13:01:09Z

Fixes: CVE-2026-55404 Changes: https://github.com/yt-dlp/yt-dlp/releases/tag/2026.07.04 Signed-off-by: George Sapkin

yt-dlp: add version check override

2026-06-14T11:11:15Z

Move version check to override script. Signed-off-by: George Sapkin

yt-dlp: bump to 2026.06.09

2026-06-14T11:11:15Z

Fixes: CVE-2026-50019 Fixes: CVE-2026-50023 Fixes: CVE-2026-50574 Changes: https://github.com/yt-dlp/yt-dlp/releases/tag/2026.06.09 Signed-off-by: George Sapkin

treewide: add or correct license information

2026-06-08T13:29:56Z

Add or correct license information across multiple packages. Signed-off-by: Wei-Ting Yang

gst1-plugins-base: pin GStreamer GL to the GLES2/EGL API

2026-06-01T23:32:31Z

The 'gl_api' meson option was left at its 'auto' default, so the GL plugin probed for desktop OpenGL. OpenWrt's Mesa is built with -Dglx=disabled and -Dglvnd=disabled on every target, so it ships no linkable desktop-GL library (no libGL.so, no gl.pc) - desktop GL is only reachable through EGL. With nothing to satisfy the probe in the sysroot, meson's cc.find_library('GL') fallback escaped into the build host's /usr/lib and, on a host that has a desktop libGL installed, put that foreign library on the link line, breaking the cross link with: mold: fatal: /usr/lib/libGL.so: incompatible file type: riscv64 is expected but got x86_64 Pin -Dgl_api=gles2 and -Dgl_platform=egl to match what Mesa actually provides (libGLESv2 + libEGL). This is correct on every target, including x86_64: the desktop-GL link path was never functional on OpenWrt and only ever "succeeded" by picking up a host library. Signed-off-by: Daniel Golle

xupnpd: add version check override

2026-05-25T05:02:47Z

Skip version checks as none of the executables seem to report their versions. Signed-off-by: George Sapkin

minidlna: fix creation of /var/etc on start

2026-05-16T07:56:53Z

When dnsmasq is disabled, /var/etc doesn't exist. minidlna start was then failing. Partially reverted commit 733aae9 which broke this. Signed-off-by: Peter Maivald

gstreamer1: add libatomic dependency for 32-bit arm targets

2026-05-14T19:16:36Z

arm926ej-s (ARMv5) does not have native lock-free atomics and the toolchain inserts calls to libatomic.so.1 for atomic operations. The libgstreamer1 DEPENDS only listed armeb, powerpc, mips and mipsel as needing libatomic, missing plain arm (little-endian 32-bit ARM). Extend the condition to include arm so the package is properly declared on all 32-bit ARM targets that require libatomic. Signed-off-by: Alexandru Ardelean

treewide: cleanup URLs

2026-05-08T20:28:27Z

This commit converts plain HTTP URLs to HTTPS, and updates old or outdated URLs. Signed-off-by: Yanase Yuki

imagemagick: update to 7.1.2-21

2026-05-06T18:05:36Z

Security fixes (18 GHSAs addressed between 7.1.2-1 and 7.1.2-21): - Fix stack buffer overflow in MagnifyImage (GHSA-rqq8-jh93-f4vg, high) - Fix heap buffer overflow in WaveletDenoiseImage (GHSA-5ggv-92r5-cp4p) - Fix uninitialized pointer dereference in JBIG decoder (GHSA-wj8w-pjxf-9g4f, high) - Fix heap buffer over-write in PNG encoder with large profiles (GHSA-qmw5-2p58-xvrc) - Fix heap buffer overflow in UHDR encoder (GHSA-h95r-c8c7-mrwx) - Fix stack buffer overflow in sixel encoder (GHSA-49hx-7656-jpg3) - Fix heap-buffer-overflow in NewXMLTree XML parsing (GHSA-gc62-2v5p-qpmp) - Fix heap buffer over-write on 32-bit systems in SFW decoder (GHSA-56jp-jfqg-f8f4) - Add overflow checks to BMP/DIB, SGI, PS3, JXL, and sixel write paths Bug fixes: - Fix double-free in SVG gradientTransform/transform parsing - Fix NULL pointer dereference in HEIC NCLX color profile allocation - Fix heap over-read in BilateralBlurImage with even-dimension kernels - Fix infinite loop when decoding JXL with -limit height/width - Fix race condition using properties instead of global splaytree Signed-off-by: Alexandru Ardelean