c-ares: bump to 1.34.8

Update c-ares from 1.34.6 to 1.34.8.

Version 1.34.7 includes the following security fixes:

* CVE-2026-33630 (GHSA-6wfj-rwm7-3542): fix a use-after-free /
  double-free issue in query-completion handling.
* CVE-2026-69184 (GHSA-pjmc-gx33-gc76): limit DNS name compression
  pointer traversal to prevent CPU-exhaustion denial of service.
* CVE-2026-69186 (GHSA-jv8r-gqr9-68wj): validate DNS record counts
  before allocation to prevent memory-amplification denial of service.

It also fixes the UDP socket exhaustion regression introduced in 1.34.6.

Version 1.34.8 reverts an unintended API break introduced in 1.34.7 by
the callback parameter const changes.

Signed-off-by: Karen Khachatryan <redacted>

diff --git a/libs/c-ares/Makefile b/libs/c-ares/Makefile
index af548eacdeeeb96f26f4f805af00011fd1a84fc6..1cc439d44e1be3952b2595f20c7082423bf4132c 100644 (file)
--- a/libs/c-ares/Makefile
+++ b/libs/c-ares/Makefile
@@ -9,12 +9,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=c-ares
-PKG_VERSION:=1.34.6
+PKG_VERSION:=1.34.8
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://github.com/c-ares/c-ares/releases/download/v$(PKG_VERSION)
-PKG_HASH:=912dd7cc3b3e8a79c52fd7fb9c0f4ecf0aaa73e45efda880266a2d6e26b84ef5
+PKG_HASH:=c222b6d681096f9444d2c4863d2c1174019e27cacca0a4a5c114d36dd7d7bf78
 
 PKG_LICENSE:=MIT
 PKG_LICENSE_FILES:=LICENSE.md