1.32 declares a tomlkit dependency, which the host build rejects as
unmet. It is only reached by the "hatchling version" CLI, not by the
PEP 517 backend the feed uses, so patch it out rather than package
tomlkit for an unreachable code path.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Upstream lists a single change for this release, support for Python
3.15, so this only keeps the package current; the free-threading fixes
to the C lookup caches are queued for 8.7 and are not in it.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
0.5.7 renames the sdist's top directory from python-gnupg-0.5.7 to
python_gnupg-0.5.7, so set PYPI_SOURCE_NAME to make PKG_BUILD_DIR match
what the tarball extracts to. pypi.mk then derives the same PKG_SOURCE
that the explicit line held, so drop it.
Add 001-relax-setuptools-constraint.patch: 0.5.7 tightens its build
requirement to "setuptools >= 68,<75", which the feed's setuptools
84.0.0 does not satisfy, so the build fails with an unmet
"setuptools<75,>=68" dependency. The cap is precautionary and the
package builds unchanged without it.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
1.2.1 fixes a SQL injection via wrongly escaped bytes parameters on the
big5, gbk, sjis, cp932 and gb18030 charsets (GHSA-x4f8-9hx9-hpp9).
Drop the pymysql.converters assertions from test.sh: escape_dict is now
a non-callable placeholder kept only for aiomysql, and upstream states
the module is internal with no compatibility guarantee.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Picks up the 3.18.2 security fixes: GHSA-33wh-fxxf-88vv hardens content
negotiation against large Accept headers, GHSA-3547-9m27-7rxg refuses
non-text encoding charsets, and GHSA-xw6w-gcfp-cf8m makes deleting a
TokenProxy actually delete the token. 3.18.3 then reverts the
order_by_precedence() return value, which 3.18.2 had changed by
mistake.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Security release: CVE-2026-77050 (denial of service in
get_supported_language_variant()), CVE-2026-84429 (denial of service in
parse_header_parameters(), reachable through the Accept and
Content-Type headers), CVE-2026-87890 (request forgery via spatial
lookup byte values) and CVE-2026-87975 (privilege abuse in model
formsets with editable primary keys). It also completes an
insufficient mitigation of CVE-2026-15307 shipped in 6.1.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Single fix: the precision defaults for the e/E format types, added in
2.3.0, were processed wrongly and the formatter emitted its own format
string instead of a number -- format(sin(1), ".10De") returned
"%.10.6RDe" rather than "8.4147098480e-01".
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Hardens the reader against crafted databases: decoding now caps a
record at 65536 values, 512 levels of nesting and 2 MiB of string and
bytes payload, rejects unsigned integers over 16 bytes and signed ones
over 4 bytes before reading their payload, and rejects an invalid
search tree size when opening a database. Those, and the truncated
reads that used to surface as IndexError or struct.error, all raise
InvalidDatabaseError now.
Upstream vendors libmaxminddb 1.14.0 for the same limits in the C
extension; this package links the feed's libmaxminddb instead, so that
half arrives with a libmaxminddb bump.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
4.15.1 raises the typing_extensions requirement marker from
python_version < "3.13" to < "3.15", so it is now a real runtime
dependency on python 3.14 and importing anyio fails without it.
Add python3-typing-extensions to DEPENDS.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
The single change is a new "towncrier-fragments-zerover" version
scheme: like towncrier-fragments, but while the last tag is still 0.x a
breaking or removal fragment bumps the minor version and only a major
fragment proposes 1.0.0. Nothing else moves; this keeps the package in
step with setuptools-scm, which shares its repository.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
The 10.3.x series is a chain of fixes to one regression: 10.3.0 let
version inference return before discovering a workdir, and the egg_info
mixin read that missing workdir as "looked and found no checkout",
which suppressed the setuptools.file_finders chain. Builds then
succeeded with the right version and an sdist and wheel missing every
SCM-tracked file that setuptools' own package discovery does not find.
10.3.3 fixed it for a pretended version, 10.3.4 for projects whose
pyproject.toml sits in a subdirectory of the checkout.
10.3.4 also raises the vcs-versioning floor to 2.5.0, which the feed
already ships.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
The feed reverted python-flit-core to 3.12.0, which satisfies the
upstream "flit_core >=3.11,<4" build requirement, so the relaxation
patch is no longer needed.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
The feed reverted python-flit-core to 3.12.0, which satisfies the
upstream "flit_core<4,>=3.11" build requirement, so the relaxation
patch is no longer needed.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Upstream now caps flit_core at <5, which the feed's 3.12.0 satisfies, so
drop 010-relax-flit-core-constraint.patch.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Upstream now caps flit_core at <5, which the feed's 3.12.0 satisfies, so
drop 010-relax-flit-core-constraint.patch.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Update to the latest upstream release and drop
001-cffi-build-rs-derive-include-from-pyo3-cross.patch, which is
part of this release.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
cryptography 50.0.2 requires "maturin>=1.14.1,<2" as its build
backend, which 1.13.1 does not satisfy.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Refresh sha256 from the PyPI sdist.
26.4.0 drops OpenSSL.crypto.X509Req and dump_certificate_request, so
test.sh can no longer import them; remove them and the CSR block. CSR
handling now lives in cryptography.x509, which is not this package.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
The override lists every python3 package by name, so it has to change
whenever the package set does, and it cannot be used as is on branches
that build a different set, like libpython3-3.13 and python3-email on
openwrt-25.12.
Check the interpreter, python3-dev and libpython3-X.Y against the
version, and accept the standard library modules and -src packages by
pattern, since they ship no executables. python3-dev now gets a real
check through python3-config and patchlevel.h, because python3-config
prints no version.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
libatomic is only needed where the compiler does not inline 64-bit
atomics, but the package depends on it on every target.
ATOMIC64_DEPENDS restricts the dependency to those targets.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Adds support for setuptools 84.
chardet-normalizer has been broken since setuptools 84 was merged in
6211fee354
Signed-off-by: Austin Lane <vidplace7@gmail.com>
Refresh PKG_HASH from the python.org release tarball, and bump
PYTHON3_PIP_VERSION to 26.2.1 to match the pip wheel bundled in 3.14.7's
ensurepip (it already matches the python-pip package version).
Refresh the patches against the new source; only the hunk offsets shift.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
d883c02a41 ("python3: pin host curses to the SDK's narrow ncurses",
2026-05-28) forced every curses header check Python's configure.ac
runs to "no", specifically to keep host ncurses's (then narrow-only)
build from being shadowed by whatever curses headers the build host's
own distro happened to ship under /usr/include.
That assumption broke when openwrt/openwrt@18725c45a3 ("ncurses:
bump to 6.6.20260801") switched host ncurses to track ncurses' git
snapshots rather than the old 6.4 tarball: ncurses 6.6+ defaults to
building wide-character support for ABI 6 (cf_dft_widec, gated on
cf_cv_abi_default which is just the major version - this is a policy
change accumulated in ncurses' own git history since 6.4 was tagged,
not something OpenWrt or ncurses deliberately changed for wide-char
specifically). Host ncurses now produces ncursesw.pc/panelw.pc, which
Python 3.14's configure.ac finds independently via its own
PKG_CHECK_MODULES(CURSES, ncursesw)-style pkg-config probe ("checking
for ncursesw... yes") - a check that was never gated by these ac_cv_*
overrides in the first place. That flips on the wide-character code
paths in Modules/_cursesmodule.c, while the ac_cv_header_ncursesw_*=no
overrides still force the *header* checks to fail, so the actual
#include falls through to the stale narrow ncurses/ncurses.h. The
result is a mismatch between what pkg-config says is available and
what header actually got included, producing:
./Modules/_cursesmodule.c: error: implicit declaration of function
'unget_wch'; did you mean 'ungetch'?
(and similarly for wget_wch, wins_nwstr, mvwins_nwstr - every
wide-character-only curses function).
Fix this at the python3/ncurses integration boundary rather than by
touching ncurses' own host build behaviour globally (see
openwrt/openwrt#24811, which tried --disable-widec on host ncurses
and had to be reverted: it also drops extended colors from host tic,
shrinking MAX_ENTRY_SIZE 32768->4096 so tic can no longer process the
xterm/xterm-256color terminfo entries needed to assemble the target
terminfo package). Since host ncurses's own -I.../include/ncursesw
already gets added via pkg-config's Cflags substitution regardless of
these overrides, stop forcing ac_cv_header_ncursesw_{ncurses,panel}_h
to "no" - configure now genuinely finds ncursesw/ncurses.h in
staging_dir/hostpkg, consistent with what its own pkg-config check
already reports, and both detection paths agree.
ac_cv_header_ncursesw_curses_h stays forced, along with the bare
(non-w) curses.h/ncurses.h/panel.h checks: host ncurses is configured
with --without-curses-h, so staging_dir/hostpkg/include/ncursesw/ has
no curses.h of its own to genuinely detect - a real "yes" here could
only ever come from the build host's own /usr/include/ncursesw/
curses.h (e.g. Fedora's ncurses-devel), the exact distro-shadowing
this override block exists to prevent.
Verified end to end: clean host python3 rebuild against unmodified
current ncurses compiles Modules/_cursesmodule.c and
Modules/_curses_panel.c without error, and the resulting
staging_dir/hostpkg python3.14 successfully `import curses` with
unget_wch present.
Fixes: d883c02a41 ("python3: pin host curses to the SDK's narrow ncurses")
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
userpath adds to and removes from the user's PATH. Its only consumer in
the feed was pipx, which has just been removed, so python-userpath now
has no users. Remove it as well.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
pipx installs and runs Python applications in isolated virtual
environments. That workflow sees little use on OpenWrt's embedded
targets, and keeping the package current has become a recurring
maintenance burden as upstream keeps adding build- and run-time
dependencies to support it. Nothing in the feed depends on pipx, so
remove it.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Alexandru Ardelean
Josef Schlehofer
Austin Lane
Daniel Golle
Wei-Ting Yang