update dnsmasq, fix CVEs

[caixingcheng]

CVE-2026-4892
CVE-2026-4893
CVE-2026-5172
CVE-2026-2291

[j-sallyjin]

PR Review Summary

✅ What looks good

• Updates dnsmasq binaries for all affected platform paths in the PR scope:
  • platform/gold/bin/dnsmasq
  • platform/gold/bin/u22/dnsmasq
  • platform/pse/bin/dnsmasq
  • platform/purple/bin/dnsmasq
• The replacement binaries preserve the expected architecture families:
  • Gold / Gold U22: x86-64 ELF
  • PSE / Purple: aarch64 ELF
• No linked GitHub issue found.

⚠️ Issues found

• Medium: CVE fix cannot be independently verified from the PR.
  The PR is binary-only and lists CVE-2026-4892, CVE-2026-4893, CVE-2026-5172, and CVE-2026-2291, but it does not include the upstream dnsmasq version, source commit, package version, downstream patch reference, build command, or checksum/provenance table. For a security update, reviewers need enough metadata to confirm these artifacts actually contain the intended fixes.

• Medium: Binary version metadata is not useful for validation.
  String inspection still shows dnsmasq-UNKNOWN / generic Dnsmasq version %s metadata, so the binaries themselves do not clearly expose the patched dnsmasq version.

💡 Suggestions

• Add a PR body section with:
  • upstream dnsmasq version or exact patch commits
  • build environment and build command
  • per-platform dnsmasq --version output
  • SHA256 checksums for all four new binaries
  • smoke test results for startup, DNS forwarding, DHCPv4, and DHCPv6
• If these binaries come from distro packages, document the exact package versions used for each platform, especially the U22 binary.

Verdict

REQUEST_CHANGES

---

Repo: firewalla/firerouter
PR: #1901
Head SHA: fb9b4d7ac4a10c1f47b25aabd4c09c3551e032e2
Checked at: 2026-06-11 09:39:06 CST