packages/multimedia, branch master

imagemagick: update to 7.1.2-21

2026-05-06T18:05:36Z

Security fixes (18 GHSAs addressed between 7.1.2-1 and 7.1.2-21): - Fix stack buffer overflow in MagnifyImage (GHSA-rqq8-jh93-f4vg, high) - Fix heap buffer overflow in WaveletDenoiseImage (GHSA-5ggv-92r5-cp4p) - Fix uninitialized pointer dereference in JBIG decoder (GHSA-wj8w-pjxf-9g4f, high) - Fix heap buffer over-write in PNG encoder with large profiles (GHSA-qmw5-2p58-xvrc) - Fix heap buffer overflow in UHDR encoder (GHSA-h95r-c8c7-mrwx) - Fix stack buffer overflow in sixel encoder (GHSA-49hx-7656-jpg3) - Fix heap-buffer-overflow in NewXMLTree XML parsing (GHSA-gc62-2v5p-qpmp) - Fix heap buffer over-write on 32-bit systems in SFW decoder (GHSA-56jp-jfqg-f8f4) - Add overflow checks to BMP/DIB, SGI, PS3, JXL, and sixel write paths Bug fixes: - Fix double-free in SVG gradientTransform/transform parsing - Fix NULL pointer dereference in HEIC NCLX color profile allocation - Fix heap over-read in BilateralBlurImage with even-dimension kernels - Fix infinite loop when decoding JXL with -limit height/width - Fix race condition using properties instead of global splaytree Signed-off-by: Alexandru Ardelean

graphicsmagick: update to 1.3.46

2026-05-06T18:05:36Z

Security fixes: - Fix MSL/SVG parsers to use libxml2 SAX handlers, removing archaic cruft with potential security issues - Fix JP2 Jasper max_samples calculation to avoid DoS via huge images - Apply image dimension resource limits and fix heap write overflow in JXL - Fix WPG palette buffer allocation (SF bug #750) - Fix ColorFloodfillImage() to error when clip-mask is present Bug fixes: - Fix JPEG CMYK inversion regression introduced in 1.3.43 - Re-implement PNG8 writer with correct indexed-color and binary transparency - Re-write HEIF reader (AVIF, HEIC) based on heif_image_get_plane_readonly2(), adding deep image support and YCbCr/monochrome output - Fix Hull transform arithmetic overflow regression from Oct 2023 - Fix -crop percentage tiling regression - Re-enable EXPERIMENTAL_EXIF_TAGS by default with known issues fixed - Fix Magick++ thread safety regression since 2003 (pthreads support) New features: - Add support for newer Artifex urw-base35-fonts (OpenType and Type 1) - Add ImagesResource limit to control simultaneous loaded images - Add EXIF Version 3.0 decoding and validation - Add preliminary MP4 coder with HEIF sequence support - Require C99 compiler compatibility in build infrastructure Signed-off-by: Alexandru Ardelean

treewide: set me where PKG_MAINTAINER empty

2026-04-16T18:48:36Z

Seems a lot of packages are just getting abandoned by people. Will pick these up and see them through. Signed-off-by: Alexandru Ardelean

tvheadend: update to 2026-04-03 (395afb8512d0)

2026-04-11T07:04:30Z

I could not reproduce the bug reported, but the update should fix it anyway. Tested on Turris Omnia, OpenWrt r31111. Signed-off-by: Marius Dinu [imported from mailing list] Signed-off-by: Hannu Nyman

python3: merge python3-email into python3-urllib

2026-04-04T15:27:26Z

As we're seeing in various test.sh scrip runs, importing 'email' fails with not finding 'urllib' and vice-versa. Then via a7e96ec91 ("python3-email: add python3-urllib as dependency") I created a circular dependency. So, might as well merge the two packages into one (named python3-urllib) and updates all dependencies to pull python3-urllib. Signed-off-by: Alexandru Ardelean

yt-dlp: bump to 2026.03.17

2026-03-23T02:40:49Z

Changes: https://github.com/yt-dlp/yt-dlp/releases/tag/2026.03.13 Changes: https://github.com/yt-dlp/yt-dlp/releases/tag/2026.03.17 Signed-off-by: George Sapkin

ffmpeg: document BUILD_PATENTED in package description

2026-03-22T12:35:19Z

Add a note indicating that patented codecs and technologies are available when CONFIG_BUILD_PATENTED=y. Signed-off-by: Wei-Ting Yang

multimedia/icecast: fix PKG_CPE_ID

2026-03-20T13:54:56Z

cpe:/a:xiph:icecast is the correct CPE ID for icecast: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:xiph:icecast Fixes: a36f265f767da363b60ef09a3b72bb84d9d3cf33 (icecast: Update to 2.4.4) Signed-off-by: Fabrice Fontaine

multimedia/go2rtc: assign PKG_CPE_ID

2026-03-19T12:38:04Z

cpe:/a:alexxit:go2rtc is the correct CPE ID for go2rtc: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:alexxit:go2rtc Signed-off-by: Fabrice Fontaine

multimedia/grilo: assign PKG_CPE_ID

2026-03-15T07:19:46Z

cpe:/a:gnome:grilo is the correct CPE ID for grilo: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:gnome:grilo Signed-off-by: Fabrice Fontaine