Repository navigation
Conversation
https://blog.rust-lang.org/2026/05/28/Rust-1.96.0/ Fixes the following CVEs: CVE-2026-5222: https://blog.rust-lang.org/2026/05/25/cve-2026-5222/ CVE-2026-5223: https://blog.rust-lang.org/2026/05/25/cve-2026-5223/ Signed-off-by: Bernd Kuhls <bernd@kuhls.net> Signed-off-by: Julien Olivain <ju.o@free.fr>
https://blog.rust-lang.org/2026/06/30/Rust-1.96.1/ Fixes CVE-2025-15661, CVE-2026-55199 & CVE-2026-55200. Signed-off-by: Bernd Kuhls <bernd@kuhls.net> Signed-off-by: Julien Olivain <ju.o@free.fr>
https://blog.rust-lang.org/2026/07/09/Rust-1.97.0/ Rust received a change in Cargo's vendoring logic which produces different vendor directory contents: Add $comment to .cargo-checksum.json to clarify this file is not a security mechanism. rust-lang/cargo#16967 Therefore the hashes of all Cargo-fetched packages need to be updated. This commit changes the suffix of Cargo packages from -cargo5 to -cargo6, and updates all hashes. Signed-off-by: Bernd Kuhls <bernd@kuhls.net> Signed-off-by: Julien Olivain <ju.o@free.fr>
https://blog.rust-lang.org/2026/07/16/Rust-1.97.1/ Signed-off-by: Bernd Kuhls <bernd@kuhls.net> Signed-off-by: Julien Olivain <ju.o@free.fr>
Contributor
|
Buildroot will be updated for v45. So no need to bump individual packages. I understand you may not have the older rust image like we do for v44.hence suggesting the update. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bump
rust/rust-binfrom 1.95.0 to 1.97.1 by cherry-picking the upstream Buildroot commits, in order:c0b3d919a1security bump to 1.96.06021eda8a7security bump to 1.96.1e8c8bd9bc5bump to 1.97.034d7758626bump to 1.97.1Fork-specific adjustments
Upstream 1.97.0 changes the Cargo vendor suffix from
-cargo5to-cargo6(Cargo now adds a$commentto.cargo-checksum.json), so every Cargo package hash changes. Our fork pins older versions of some packages, so upstream's hashes don't apply and the cherry-pick conflicted:python-cryptography(47.0.0),broot(1.56.2),netavark(1.17.0),aardvark-dns(1.17.0): kept the fork's versions and regenerated the-cargo6hashes with the 1.97.1 toolchain. These are not an upstream bump.dtui: not present in this fork, so upstream's hash change was dropped.Testing
python-cryptographyhash verified by that build.broot,netavarkandaardvark-dnshashes verified by fetching each package with the 1.97.1rust-bintoolchain (make <pkg>-source) in a scratch config. They are not part of the board config.https://claude.ai/code/session_012SzrKCG5QK38mhxCGtiGQR