staging/stintel/package/libs, branch master

openssl: update to 3.5.8

2026-08-29T10:32:59Z

Update OpenSSL to 3.5.8, a security patch release. This fixes: - CVE-2026-18798 - CVE-2026-63072 - CVE-2026-63076 - CVE-2026-14456 - CVE-2026-14457 - CVE-2026-54874 - CVE-2026-63073 - CVE-2026-63074 - CVE-2026-63075 - CVE-2026-75803 Link: https://openssl-library.org/news/secadv/20260825.txt Signed-off-by: Peter Polonec Link: https://github.com/openwrt/openwrt/pull/24915 Signed-off-by: Hauke Mehrtens

ncurses: bump to 6.6.20260801

2026-08-19T11:13:20Z

Upgrade ncurses snapshot 6.6.20260801. This includes fixes that enable the maintained patches to be dropped. It also introduces additional terminfo files for the terminal emulator ghostty. Signed-off-by: Charlie Jenkins

ncurses: Skip terminfo database install on host

2026-08-19T11:13:20Z

Since the introduction of the host package for ncurses, it has attempted to install terminfo files directly into the build machine's /usr/lib. When not root, this silently fails to install. On ncurses versions after v6_4_20230708, ncurses fails to install instead of silently failing. Remove the host terminfo database installation to avoid this unexpected behavior. Signed-off-by: Charlie Jenkins

ncurses: Change from using packaged tarballs to git releases

2026-08-19T11:13:20Z

The ncurses tarballs are infrequently released. Start building ncurses from the git repo to be able to get fixes and improvements quicker. Signed-off-by: Charlie Jenkins

ncurses: Add CONFIG_LIBNCURSES_TERMINFO

2026-08-19T11:13:20Z

Introduce a config, CONFIG_LIBNCURSES_TERMINFO, that allows a user to install additional terminfo files into the target filesystem. This helps avoid needing to add arbitrary additional terminfo files to the default list while still providing an easy way to include the files. Signed-off-by: Charlie Jenkins

wolfssl: update to 5.9.2

2026-08-13T19:57:45Z

Release notes: https://github.com/wolfSSL/wolfssl/releases/tag/v5.9.2-stable This is a security release fixing 32 CVEs (6 High, 15 Med, 11 Low). Many of them apply to the configuration built here: --enable-opensslall and --enable-opensslextra are unconditional, and TLS 1.3, session tickets and OCSP stapling default to y. Fixes CVEs: - CVE-2026-11310 (High) - CVE-2026-11999 (High) - CVE-2026-6679 (High) - CVE-2026-55958 (High) - CVE-2026-55960 (High) - CVE-2026-55961 (High) - CVE-2026-6731 (Med) - CVE-2026-6091 (Med) - CVE-2026-6094 (Med) - CVE-2026-6329 (Med) - CVE-2026-6330 (Med) - CVE-2026-8720 (Med) - CVE-2026-10097 (Med) - CVE-2026-10098 (Med) - CVE-2026-10592 (Med) - CVE-2026-7532 (Med) - CVE-2026-6291 (Med) - CVE-2026-7511 (Med) - CVE-2026-11703 (Med) - CVE-2026-55962 (Med) - CVE-2026-55964 (Med) - CVE-2026-6092 (Low) - CVE-2026-6331 (Low) - CVE-2026-6681 (Low) - CVE-2026-10512 (Low) - CVE-2026-6678 (Low) - CVE-2026-7531 (Low) - CVE-2026-6325 (Low) - CVE-2026-6412 (Low) - CVE-2026-6450 (Low) - CVE-2026-12340 (Low) - CVE-2026-55967 (Low) OCSP responder authorization is now strictly enforced per RFC 6960 4.2.2.2. The CheckOcspResponderChain() fallback, which accepted any responder certificate issued by an ancestor of the target's issuer, was removed. Setups relying on an indirectly issued OCSP responder will start to fail validation. Refreshed patches. Signed-off-by: Sander van Deijck Link: https://github.com/openwrt/openwrt/pull/24700 Signed-off-by: Hauke Mehrtens

libubox: update to Git HEAD (2026-07-21)

2026-08-13T00:30:27Z

17f527fb6c30 ustream: allow freeing the stream from within notify callbacks e7608b69283d blobmsg: use flexible-array member in blobmsg_name() Link: https://github.com/openwrt/openwrt/pull/24678 Signed-off-by: Hauke Mehrtens

mbedtls: update to 3.6.7

2026-08-12T00:09:37Z

This version fixes security issues and bugs. Security fixes: * Fix a side channel in RSA PKCS#1 v1.5 decryption. (CVE-2026-50587) * Fix a bug where transcript-hash computation errors during TLS 1.2 extended master secret calculation could be ignored instead of causing the handshake to fail. (CVE-2026-50581) * Fix a TLS 1.3 server-side error-handling bug affecting session ticket generation. (CVE-2026-50640) * Fix renegotiation failing and potentially causing a buffer overflow in DTLS when badmac_limit is enabled. (CVE-2026-50713) * Reject ChaCha20 operations that would make the 32-bit block counter wrap around, which could otherwise reuse keystream and compromise confidentiality. (CVE-2026-50584) * Fixed a TLS 1.3 record-boundary validation issue that could allow unauthenticated plaintext data to be processed across a key change. * Fix a possible buffer overflow in mbedtls_ecdh_calc_secret() (CVE-2026-35336) * Fix a remote buffer overflow in (D)TLS with ECDHE-PSK cipher suites when CBC is disabled. (CVE-ID-50580) * Fix a side channel in ECC computations that allows a powerful local attacker (typically, untrusted OS attacking a secure enclave) to fully recover long-term secret keys). (CVE-2026-54435) * Fix a potential information disclosure in TLS 1.2 servers using session tickets. (CVE-2026-50586) * Fix timing side channel in RSA key generation, prime generation and primality testing, on platforms where division is not constant-time. * Fix a 1-byte buffer overread when parsing a malformed ECC public key in the PK module. (CVE-2026-50583) * Fix an out-of-bounds read when parsing TLS 1.2 ECJPAKE ServerKeyExchange messages. (CVE-2026-50588) * Fix a use-after-free/double-free risk in mbedtls_pkcs7_free() when reusing an mbedtls_pkcs7 context across parse -> free -> parse -> free cycles. (CVE-2026-50579) * PKCS7 now rejects weak hash algorithms (RIPEMD160, MD5, SHA-1, SHA-224, SHA3-224) on signature verification. * Improved documentation of mbedtls_ssl_conf_sig_algs() to emphasize that this function only sets signature algorithms that are enforced during TLS key exchange and not on certificate verification. (CVE-2026-54441) * Ensure 'dtls_srtp_info' field from 'mbedtls_ssl_context' is properly zeroized when mbedtls_ssl_session_reset() is called. (CVE-2026-50585) * Fix a bug where mbedtls_ssl_read() and mbedtls_ssl_write() could return 1 instead of an error code if the random generator failed when a server called these functions before the end of a TLS 1.3 handshake. * Fix TLS 1.3 clients to reject a HelloRetryRequest whose selected group was not advertised in the original ClientHello. (CVE-2026-25832) * Fix two bugs in the X.509 certificate parser that caused some inputs with a malformed basicConstraints extension to be accepted. (CVE-2026-49300) Full release notes: https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-3.6.7 Remove backported upstream patches that are included in this release. Signed-off-by: Magnus Kroken Link: https://github.com/openwrt/openwrt/pull/24131 Signed-off-by: Hauke Mehrtens

gettext-full: update to 0.24.2

2026-07-30T17:40:44Z

Update to a newer bugfix release of gettext. This version includes a commit to make adjustments according to changes in gnulib in early 2025. Add DEPENDS variable to package definition in order to enforce the correct build order, which should have been done when libunistring and libxml2 packages were moved to openwrt core. No patch requires refresh. Signed-off-by: Michael Pratt Link: https://github.com/openwrt/openwrt/pull/24247 Signed-off-by: Robert Marko

mbedtls: fix arm32 build errors with GCC 15.3

2026-07-14T20:50:47Z

It seems that GCC 15.3 has added additional OOB checks for ARCH arm32. Signed-off-by: Shiji Yang Link: https://github.com/openwrt/openwrt/pull/23774 Signed-off-by: Jonas Jelonek