[Buildroot] [PATCH] package/memcached: security bump version to 1.6.45

[Buildroot] [PATCH] package/memcached: security bump version to 1.6.45

[Franciszek Stachura]

https://github.com/memcached/memcached/wiki/ReleaseNotes1644
> Hot on the heels of the last security release is...
> another security release

https://github.com/memcached/memcached/wiki/ReleaseNotes1645
> So this is a lot of crash and security bugs.

Signed-off-by: Franciszek Stachura <fbstachura@gmail.com>
---
I'm wondering, are packages in Buildroot master supposed to be
bleeding-edge? The maintainer also left this in the release notes:

> If you decide to deploy this please be cautious; use a canary server
> and let it bake, just in case.

That said, 1.6.45 was released a month ago and I don't see any critical
bugs reported in Github issues. (there are two AI-generated reports, one
is not considered a security issue, the POC of the other does not work).
---
 package/memcached/memcached.hash | 6 +++---
 package/memcached/memcached.mk   | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/package/memcached/memcached.hash b/package/memcached/memcached.hash
index 93480d338c..6a3de856e9 100644
--- a/package/memcached/memcached.hash
+++ b/package/memcached/memcached.hash
@@ -1,5 +1,5 @@
-# From http://www.memcached.org/files/memcached-1.6.43.tar.gz.sha1
-sha1  37307d13528f355fb282bc8841ca033272e44ac9  memcached-1.6.43.tar.gz
+# From http://www.memcached.org/files/memcached-1.6.45.tar.gz.sha1
+sha1  45038980ea7045a548b9b5b5125ef7116312a768  memcached-1.6.45.tar.gz
 # Locally computed
-sha256  8042ee26e004efa0db41ca4a7c713f759c3280c2f8bee438579f13de1e509435  memcached-1.6.43.tar.gz
+sha256  d362c64e6d8d5287153501eabf7c85b4a761432fbf53f5d7b085d0bb1653c1dd  memcached-1.6.45.tar.gz
 sha256  bc887c4ad8051fe690ace9528fe37a2e0bb362e6d963331d82e845ca9b585a0c  COPYING
diff --git a/package/memcached/memcached.mk b/package/memcached/memcached.mk
index e297ca17ff..f86bd56006 100644
--- a/package/memcached/memcached.mk
+++ b/package/memcached/memcached.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-MEMCACHED_VERSION = 1.6.43
+MEMCACHED_VERSION = 1.6.45
 MEMCACHED_SITE = http://www.memcached.org/files
 MEMCACHED_DEPENDENCIES = libevent
 MEMCACHED_CONF_ENV = ac_cv_prog_cc_c99='-std=gnu99'
-- 
2.55.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH] package/memcached: security bump version to 1.6.45

[Julien Olivain via buildroot]

Hi Franciszek,

On 14/08/2026 21:00, Franciszek Stachura wrote:
> https://github.com/memcached/memcached/wiki/ReleaseNotes1644
>> Hot on the heels of the last security release is...
>> another security release
> 
> https://github.com/memcached/memcached/wiki/ReleaseNotes1645
>> So this is a lot of crash and security bugs.
> 
> Signed-off-by: Franciszek Stachura <fbstachura@gmail.com>

Applied to master, thanks.

> ---
> I'm wondering, are packages in Buildroot master supposed to be
> bleeding-edge? The maintainer also left this in the release notes:
> 
>> If you decide to deploy this please be cautious; use a canary server
>> and let it bake, just in case.
> 
> That said, 1.6.45 was released a month ago and I don't see any critical
> bugs reported in Github issues. (there are two AI-generated reports, 
> one
> is not considered a security issue, the POC of the other does not 
> work).

I don't think there is a general rule to whether have or not packages
using bleeding-edge versions in Buildroot master branch. This depends
a bit on the upstream package itself, and it's also a up to the
Buildroot package maintainer.

The general rules I would give would be to try to keep package versions
that works in Buildroot (for all cpu architectures, gcc versions, with
dependencies too, ...), and avoid using intermediate development
version which are updated too often or too unstable.

Some packages, like Wine for example, decided to use
only stable versions:
https://gitlab.com/buildroot.org/buildroot/-/blob/master/package/wine/wine.mk#L7

Best regards,

Julien.
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH] package/memcached: security bump version to 1.6.45

[Titouan Christophe via buildroot]

On 14/08/26 21:00, Franciszek Stachura wrote:
> https://github.com/memcached/memcached/wiki/ReleaseNotes1644
>> Hot on the heels of the last security release is...
>> another security release
> https://github.com/memcached/memcached/wiki/ReleaseNotes1645
>> So this is a lot of crash and security bugs.
> Signed-off-by: Franciszek Stachura <fbstachura@gmail.com>
> ---
> I'm wondering, are packages in Buildroot master supposed to be
> bleeding-edge? The maintainer also left this in the release notes:
>
>> If you decide to deploy this please be cautious; use a canary server
>> and let it bake, just in case.
> That said, 1.6.45 was released a month ago and I don't see any critical
> bugs reported in Github issues. (there are two AI-generated reports, one
> is not considered a security issue, the POC of the other does not work).

Applied to 2025.02.x and 2026.05.x, thanks !
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot