Re: [Buildroot] [PATCH] package/memcached: security bump version to 1.6.45

[Julien Olivain via buildroot <buildroot@buildroot.org>]

Hi Franciszek,

On 14/08/2026 21:00, Franciszek Stachura wrote:
> https://github.com/memcached/memcached/wiki/ReleaseNotes1644
>> Hot on the heels of the last security release is...
>> another security release
> 
> https://github.com/memcached/memcached/wiki/ReleaseNotes1645
>> So this is a lot of crash and security bugs.
> 
> Signed-off-by: Franciszek Stachura <fbstachura@gmail.com>

Applied to master, thanks.

> ---
> I'm wondering, are packages in Buildroot master supposed to be
> bleeding-edge? The maintainer also left this in the release notes:
> 
>> If you decide to deploy this please be cautious; use a canary server
>> and let it bake, just in case.
> 
> That said, 1.6.45 was released a month ago and I don't see any critical
> bugs reported in Github issues. (there are two AI-generated reports, 
> one
> is not considered a security issue, the POC of the other does not 
> work).

I don't think there is a general rule to whether have or not packages
using bleeding-edge versions in Buildroot master branch. This depends
a bit on the upstream package itself, and it's also a up to the
Buildroot package maintainer.

The general rules I would give would be to try to keep package versions
that works in Buildroot (for all cpu architectures, gcc versions, with
dependencies too, ...), and avoid using intermediate development
version which are updated too often or too unstable.

Some packages, like Wine for example, decided to use
only stable versions:
https://gitlab.com/buildroot.org/buildroot/-/blob/master/package/wine/wine.mk#L7

Best regards,

Julien.
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot