[Buildroot] [PATCH v1] package/msgpack-c: bump to version 7.0.2

[Buildroot] [PATCH v1] package/msgpack-c: bump to version 7.0.2

[Thomas Devoogdt]

Release notes since 6.1.0:
- 7.0.0: raise the minimum CMake version (3.5-4.0 policy range).
- 7.0.1: set INSTALL_INTERFACE to CMAKE_INSTALL_INCLUDEDIR.
- 7.0.2: fix integer overflow in msgpack_unpacker_expand_buffer().

Switch to the upstream release tarball, as upstream now publishes its
sha256 on the release page.

Signed-off-by: Thomas Devoogdt <thomas@devoogdt.com>
---
 package/msgpack-c/msgpack-c.hash | 3 ++-
 package/msgpack-c/msgpack-c.mk   | 4 ++--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/package/msgpack-c/msgpack-c.hash b/package/msgpack-c/msgpack-c.hash
index e4fe61f4245..da32bdf27cd 100644
--- a/package/msgpack-c/msgpack-c.hash
+++ b/package/msgpack-c/msgpack-c.hash
@@ -1,4 +1,5 @@
+# From https://github.com/msgpack/msgpack-c/releases/tag/c-7.0.2
+sha256  6ae50f69612871aa01de76bec904165cd2a2fc30ff9f653f2f60a663c5c1a86c  msgpack-c-7.0.2.tar.gz
 # Locally computed:
-sha256  c23c4070dbe01f46044bf70c5349f29453d655935b6dc710714c008bca0825a7  msgpack-c-6.1.0.tar.gz
 sha256  664550b43996452a5a2c7471bb0ff77185a58c69ccafa60f983dc4c162e1ee22  COPYING
 sha256  c9bff75738922193e67fa726fa225535870d2aa1059f91452c411736284ad566  LICENSE_1_0.txt
diff --git a/package/msgpack-c/msgpack-c.mk b/package/msgpack-c/msgpack-c.mk
index f12dcb085f4..e611aa9648d 100644
--- a/package/msgpack-c/msgpack-c.mk
+++ b/package/msgpack-c/msgpack-c.mk
@@ -4,8 +4,8 @@
 #
 ################################################################################
 
-MSGPACK_C_VERSION = 6.1.0
-MSGPACK_C_SITE = $(call github,msgpack,msgpack-c,c-$(MSGPACK_C_VERSION))
+MSGPACK_C_VERSION = 7.0.2
+MSGPACK_C_SITE = https://github.com/msgpack/msgpack-c/releases/download/c-$(MSGPACK_C_VERSION)
 MSGPACK_C_LICENSE = BSL-1.0
 MSGPACK_C_LICENSE_FILES = COPYING LICENSE_1_0.txt
 MSGPACK_C_INSTALL_STAGING = YES
-- 
2.43.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH v1] package/msgpack-c: bump to version 7.0.2

[Thomas Petazzoni via buildroot]

On Sat, Oct 24, 2026 at 06:49:05PM +0200, Thomas Devoogdt wrote:
> Release notes since 6.1.0:
> - 7.0.0: raise the minimum CMake version (3.5-4.0 policy range).
> - 7.0.1: set INSTALL_INTERFACE to CMAKE_INSTALL_INCLUDEDIR.
> - 7.0.2: fix integer overflow in msgpack_unpacker_expand_buffer().
> 
> Switch to the upstream release tarball, as upstream now publishes its
> sha256 on the release page.
> 
> Signed-off-by: Thomas Devoogdt <thomas@devoogdt.com>

Applied to master, thanks!

Best regards,

Thomas Petazzoni
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH v1] package/msgpack-c: bump to version 7.0.2

[Peter Korsgaard]

>>>>> "Thomas" == Thomas Devoogdt <thomas@devoogdt.com> writes:

 > Release notes since 6.1.0:
 > - 7.0.0: raise the minimum CMake version (3.5-4.0 policy range).
 > - 7.0.1: set INSTALL_INTERFACE to CMAKE_INSTALL_INCLUDEDIR.
 > - 7.0.2: fix integer overflow in msgpack_unpacker_expand_buffer().

So does this mean that it is a security bump and should be backported to
the LTS series?

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH v1] package/msgpack-c: bump to version 7.0.2

[Thomas Devoogdt]

[-- Attachment #1.1: Type: text/plain, Size: 673 bytes --]

Hi Peter,


After some searching, yes this is a security fix.

See https://github.com/msgpack/msgpack-c/issues/1181#issuecomment-5365155306


Kr,

Thomas Devoogdt

Op ma 26 okt 2026, 07:49 schreef Peter Korsgaard <peter@korsgaard.com>:

> >>>>> "Thomas" == Thomas Devoogdt <thomas@devoogdt.com> writes:
>
>  > Release notes since 6.1.0:
>  > - 7.0.0: raise the minimum CMake version (3.5-4.0 policy range).
>  > - 7.0.1: set INSTALL_INTERFACE to CMAKE_INSTALL_INCLUDEDIR.
>  > - 7.0.2: fix integer overflow in msgpack_unpacker_expand_buffer().
>
> So does this mean that it is a security bump and should be backported to
> the LTS series?
>
> --
> Bye, Peter Korsgaard
>
>

[-- Attachment #1.2: Type: text/html, Size: 1445 bytes --]

[-- Attachment #2: Type: text/plain, Size: 150 bytes --]

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH v1] package/msgpack-c: bump to version 7.0.2

[Peter Korsgaard]

>>>>> "Thomas" == Thomas Devoogdt <thomas@devoogdt.com> writes:

 > Hi Peter,
 > After some searching, yes this is a security fix.

 > See https://github.com/msgpack/msgpack-c/issues/1181#issuecomment-5365155306

OK, thanks. Then we should probably backport the fix to 2025.02.x:

https://github.com/msgpack/msgpack-c/pull/1182/changes/8a48af0e3ed15ce0e60273de30a073ae6419489e

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot