staging/stintel/tools, branch master

tools/expat: update to 2.8.4

2026-09-12T14:49:17Z

This version bump includes fixes for the following CVEs: - CVE-2026-66046 - CVE-2026-72522 - CVE-2026-76641 - CVE-2026-76956 - CVE-2026-76957 Full release notes: https://github.com/libexpat/libexpat/blob/master/expat/Changes Signed-off-by: Wei-Ting Yang Link: https://github.com/openwrt/openwrt/pull/25134 Signed-off-by: Hauke Mehrtens

tools: erofs-utils: update to 1.9.4

2026-09-08T08:09:34Z

ChangeLog: https://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs-utils.git/tree/ChangeLog?h=v1.9.4 Build system: x86/64 Tested on: x86/64 Signed-off-by: Andy Chiang Link: https://github.com/openwrt/openwrt/pull/24991 Signed-off-by: Robert Marko

tools/cmake: update to version 4.4.3

2026-09-06T18:08:49Z

Update cmake to version 4.4.3. (No need for patch changes) Signed-off-by: Hannu Nyman Link: https://github.com/openwrt/openwrt/pull/25043 Signed-off-by: Robert Marko

tools: gnulib: remove stale gl_-prefixed macros from staging

2026-08-19T17:46:46Z

Commit c820f097e0 ("tools: gnulib: install .m4 file with gl_ prefix") installed gnulib autoconf macros under gl_-prefixed file names. The scheme was later reverted in commit cda598a595, but the previously installed files were never removed from share/aclocal. As aclocal reads the whole directory, stale gl_*.m4 files can override the current unprefixed macros. This breaks elfutils builds on macOS after the gnulib stable-202507 update, resulting in empty #if expressions in the generated ctype.h. Remove the stale files in Host/Uninstall. Host/Install calls it first, so affected build trees are cleaned up automatically on the next gnulib reinstall. Signed-off-by: Josef Schlehofer Link: https://github.com/openwrt/openwrt/pull/24759 Signed-off-by: Robert Marko

tools: firmware-utils: update to Git HEAD (2026-07-30)

2026-08-18T23:19:54Z

df23826047c9 uimage_padhdr: improve error handling and cleanup c9da48613b5d uimage_padhdr: add options to insert data into padding area Signed-off-by: Luiz Angelo Daros de Luca Link: https://github.com/openwrt/openwrt/pull/24773 Signed-off-by: Hauke Mehrtens

tools: zip: fix command injection in -T

2026-08-17T08:36:17Z

[backport from Debian zip 3.0-16] https://sources.debian.org/data/main/z/zip/3.0-16/debian/patches/fix-command-injection.patch Info-ZIP 3.0 builds a shell command with the archive name when -T tests an archive. A crafted archive name can inject additional shell commands. Backport Debian's fix. Quote the archive name before it is added to the test command. Link: https://sintonen.fi/advisories/infozip-test-option-command-injection.txt Signed-off-by: Peter Polonec Link: https://github.com/openwrt/openwrt/pull/24730 Signed-off-by: Robert Marko

tools/meson: update to 1.11.2

2026-08-14T10:11:19Z

Remove upstreamed patch and refresh others. Signed-off-by: Rosen Penev Link: https://github.com/openwrt/openwrt/pull/24560 Signed-off-by: Jonas Jelonek

mold: bump to 2.42.0

2026-08-14T09:00:45Z

Update mold to 2.42.0 Changelog: https://github.com/rui314/mold/releases/tag/v2.42.0 Signed-off-by: Carsten Schuette Link: https://github.com/openwrt/openwrt/pull/24672 Signed-off-by: Robert Marko

tools/sed: update to 4.10

2026-08-13T21:39:03Z

Remove upstreamed patch. Remove HOST_CONFIGURE_VARS. These are not needed any more. ac_cv_search_setfilecon was removed completely and the others are guarded by if test "$with_selinux" != no; then now. Signed-off-by: Rosen Penev Link: https://github.com/openwrt/openwrt/pull/24572 Signed-off-by: Hauke Mehrtens

tools/isl: update to 0.28

2026-08-06T21:11:50Z

Basic update. No patches. Signed-off-by: Rosen Penev Link: https://github.com/openwrt/openwrt/pull/24573 Signed-off-by: Hauke Mehrtens