The online repo the .tar.xz file is downloaded from has (for unknown reasons) regenerated the download and this has caused the hash of the downloaded file to change. We see the same on GitHub sometimes.
The correct fix is updating PKG_SHA256 in package.mk to use the 'got' hash value instead of the current 'wanted' hash. The alternate workaround is setting PKG_SHA256="" (null) which disables the hash check. The one-line command vpeter posted does this.