Nixpkgs CVE, multiverse archive, GnuPG and OpenWrt ports

A high-severity Readest sanitizer flaw landed in Nixpkgs alongside an archive of every historical nixpkgs revision. GnuPG shipped a bugfix release, and OpenWrt forums saw device ports, a pbr package refresh, and a new LuCI theme.

Readest EPUB sanitizer CVE in Nixpkgs

Nixpkgs recorded CVE-2026-82642 (CVSS 8.8) for Readest after an unsanitized iframe srcdoc attribute in the EPUB sanitizer was shown to allow arbitrary code execution. The issue was filed against nixos/nixpkgs and affects users who process untrusted EPUB content through the package. Distributions relying on the sanitizer path need the fix before further EPUB handling.

Nixpkgs-multiverse exposes every historical revision

A new nixpkgs-multiverse service was announced on the NixOS discourse, offering every Nixpkgs revision that ever existed through a composable Nix API. Nineteen participants discussed the release and its implications for reproducible builds and bisecting old configurations. The archive gives developers a single interface to pin or inspect any past package set without hunting channel tarballs.

GnuPG 2.5.22 bugfix release

The GnuPG project announced version 2.5.22 as a bugfix release, calling out continued post-quantum Kyber support and the end of life of the 2.4 series. The update is aimed at users who need current crypto tooling and a supported maintenance branch. Operators still on 2.4 are expected to move forward.

Early OpenWrt port for Gl.iNet Flint 4

Blogic posted an early OpenWrt port for the Gl.iNet Flint 4 (MT7988) on the OpenWrt forum. Discussion noted that the Motorcomm YT8824 PHY driver is still missing, limiting full network bring-up. The thread tracks the remaining hardware support needed before the device can be considered usable.

OpenWrt work on Zyxel EX5601-T0

Forum users shared serial and TFTP methods plus root access workarounds while adding OpenWrt support for the Zyxel EX5601-T0 (T56). The thread collects practical recovery steps so others can flash and debug the board. Progress depends on those low-level access paths remaining reliable.

Zyxel Armor G5 (NBG7815) port nears completion

Pull request 24881 adds LED, fan, Bluetooth, and sensor support for the Zyxel NBG7815, finishing the bulk of the OpenWrt device port. Eight participants reviewed the remaining hardware pieces. The changes bring the router closer to a complete upstream target.

Policy-Based-Routing package RC testing

The pbr package is in release-candidate testing of a ucode port, with users reporting fixes for domain and file handling. A long OpenWrt forum thread collected feedback from sixteen participants. The refresh matters for anyone steering traffic by policy on current OpenWrt builds.

Footstrap LuCI theme announced

A new LuCI theme called Footstrap was announced on the OpenWrt forum and described as roughly twice as fast as bootstrap. The discussion drew adoption interest and minor UI feedback across dozens of posts. Theme choice affects responsiveness of the web administration interface on constrained routers.