This is a security release.
Notable Changes
* (CVE-2026-21637) wrap SNICallback invocation in try/catch (Matteo Collina) - High
* (CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct (Matteo Collina) - High
* (CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC (Filip Skokan) - Medium
* (CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code (RafaelGSS) - Medium
* (CVE-2026-21717) test array index hash collision (Joyee Cheung) - Medium
* (CVE-2026-21715) add permission check to realpath.native (RafaelGSS) - Low
* (CVE-2026-21716) include permission check on lib/fs/promises (RafaelGSS) - Low
Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
(cherry picked from commit 3d5f717b7a)
When Python3 was updated via commit 97a92f2e7 , distutils was
disappeared from Python3 and moved to setuptools.
So that patch should have moved here as well.
This should fix all packages which still use the 'build_ext'
module from setuptools.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Add a new netcup DDNS provider using the netcup DNS api
(ccp.netcup.net) with API key authentication.
Configuration mapping:
* username = netcup customer number
* password = netcup API password
* param_enc = netcup API key (generated in the CCP)
* domain = fully qualified subdomain to update (e.g. home.example.de)
* param_opt = (optional) root/zone domain override (e.g. example.de)
When omitted the root domain is derived by stripping the
leftmost label from 'domain'. This only works correctly for
a single subdomain level (e.g. "home.example.de").
param_opt MUST be set explicitly in two cases:
1. Deep subdomains: domain=test.internal.example.org
2. ccSLD apex domains: domain=example.co.nz
Signed-off-by: Tim Flubshi <flubshi@gmail.com>
(cherry picked from commit 10b8f04e3e)
The 'ddns-scripts' packages still uses not the procd service handling.
This commit changes this.
This change also resolves the issue where, if a UCI configuration is
already present, the process is blocked during installation via APK and
does not complete.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Tested-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
(cherry picked from commit b1502c453e)
records
Problem:
When using Cloudflare with proxy enabled (orange cloud), DNS lookups
return Cloudflare's edge IP instead of the actual origin IP registered
in the dashboard. This causes ddns-scripts to incorrectly detect IP
mismatches, triggering unnecessary updates and potential rate limiting.
Solution:
Add an optional 'use_api_check' configuration option that enables
provider scripts to fetch the registered IP directly via their API,
bypassing DNS lookups.
Changes:
- dynamic_dns_functions.sh: Add API check block to get_registered_ip()
(~25 lines). When use_api_check is enabled, sources the provider
script with GET_REGISTERED_IP=1 flag. Falls back to DNS lookup if
API check is disabled, unsupported, or fails.
- update_cloudflare_com_v4.sh: Add handler for GET_REGISTERED_IP mode
(~15 lines). Reuses existing cURL setup and authentication to query
Cloudflare API for actual record content.
- etc/config/ddns: Document use_api_check option
Behavior:
- use_api_check=0 or unset: DNS lookup (existing behavior, no changes)
- use_api_check=1 with API support: API query for registered IP
- use_api_check=1 without API support: Falls back to DNS lookup
- API failure: Gracefully falls back to DNS lookup
Testing:
- Cloudflare (proxied): Correctly retrieves origin IP via API
- Cloudflare (non-proxied): Works correctly
- No-IP: DNS lookup works (no regression)
- IPv4 and IPv6 records tested
- API failure gracefully falls back to DNS
Signed-off-by: Wayne King 244781262+bdk38@users.noreply.github.com
These LLVM builds get deleted after a certain time, causing Rust builds
to break as the LLVM build can no longer be downloaded.
Fixes#27331.
Signed-off-by: Orne Brocaar <info@brocaar.com>
(cherry picked from commit 4c3a649dd7)
`boost-python3` will be only selectable after `boost` is selected,
so add `boost` to dependencies as well.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit f35120face)
2026-01-30: Version 7.5.4
* Don't return an error code if a binary file is skipped.
Reverting change in 7.5.3.
* Refactored code.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit e0efa48e6e)
v3.17.0 changes:
- Drop Python 3.9 support (minimum now 3.10)
- Drop deprecated coreapi support
- Add Python 3.14 support
- Add ability to specify output format for DurationField
- Add missing decorators: @versioning_class(), @content_negotiation_class(),
@metadata_class() for function-based views
- Support violation messages in UniqueConstraint
Full release notes:
https://github.com/encode/django-rest-framework/releases/tag/3.17.0
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit facb68ee69)
The RFC-1918 zones are automatically synthesized locally by bind
to avoid forwarding queries about them to root nameservers. As
a result, we can't easily replace them with rndc addzone on the
fly. We need this for DHCP integration.
Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
(cherry picked from commit 505ca0a0d4)
Changelog since 2.2.2:
- Add mpz.array() method for NumPy interaction
- Implement mpq.limit_denominator() functionality
- Add is_integer() method for mpz/mpq types
- Add mixed-mode arithmetic support for mpc types
- Enhanced formatting using context's rounding mode defaults
- Full free-threaded Python build support
- Fix memory leaks in MPFR/MPC cache and context exit
- Drop CPython 3.8 support (requires 3.9+)
Add test.sh.
gmpy2 2.3.0 switched to pyproject.toml with setuptools-scm for version
management. Add python-setuptools-scm/host to PKG_BUILD_DEPENDS.
Full changelog:
https://github.com/aleaxit/gmpy/releases
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit 643e0bd695)
Changelog since 24.7.2:
- Switch build system from wheel to hatchling
- Switch runtime dependency from setuptools/pkg-resources to packaging
- Add CLI script (pipx run incremental)
- Add Python 3.13 and 3.14 support; drop Python 3.8 support
- Drop Click dependency from CLI
Update HOST_BUILD_DEPENDS to use python-hatchling/host instead of
python-wheel/host, and replace +python3-pkg-resources dependency with
+python3-packaging in DEPENDS.
Add test.sh.
Full changelog:
https://github.com/twisted/incremental/releases
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit 6fc55f8b74)
Pillow 12.x introduces pybind11-based C extension bindings and a
custom build backend (wrapping setuptools.build_meta). This requires:
- Replacing python-setuptools-scm with python-setuptools as build dep
- Adding python-pybind11 as a new build dependency (host)
- Updating build config settings from --build-option flags to the new
key=value format (e.g. zlib=enable, imagequant=disable)
- Removing the separate webpmux flag (merged into webp feature)
Full release notes:
https://pillow.readthedocs.io/en/stable/releasenotes/index.html
Remove 001-remove-setuptools-version-limit.patch
That's an old relic since when setuptools was packaged inside Python3
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit df78cf6b01)
pybind11 is a header-only library that exposes C++ types in Python,
used as a build-time dependency by packages like Pillow 12.x.
Uses setuptools as its build backend.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit 432fa809dd)
And disable custom build-backend in order to use setuptools.
Signed-off-by: Jean Thomas <jean.thomas@wifirst.fr>
(cherry picked from commit ef77e07976)
* add: ucode-mod-uloop dependency
* add: parallel downloads using uloop
* fix: explicit allow for domains from allow-lists
* fix: get environment information for getInitStatus RPCD call
* add: update tests
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit 65ed2877ef)
Signed-off-by: Stan Grishin <stangri@melmac.ca>
* fix: ensure output in CLI in status and quick start commands
* fix: ensure relevant directories exist when using a (gzip) cache file on
first boot
* add: update functional tests
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit f4e6ada26d)
Signed-off-by: Stan Grishin <stangri@melmac.ca>
Adds the misssing build dependencies to remove the
"Cannot import 'setuptools.build_meta'" build error with 25.12.0-rc1 to 25.12.0-rc5
Signed-off-by: dwardor <benjamin.reveille@gmail.com>
(cherry picked from commit 6b3c95cbd8)
Daniel Golle
Hirokazu MORIKAWA
Alexandru Ardelean
Luiz Angelo Daros de Luca
Tim Flubshi
Florian Eckert
Patrick Hemmen
bdk38
Lin Fan
Fabrice Fontaine
Tianling Shen
Orne Brocaar
Niklas Thorild
Wei-Ting Yang
Eric Fahlgren
Noah Meyerhans
Philip Prindeville
Jean Thomas
Josef Schlehofer
Stan Grishin
Dirk Brenken
dwardor