1.2.1 fixes a SQL injection via wrongly escaped bytes parameters on the
big5, gbk, sjis, cp932 and gb18030 charsets (GHSA-x4f8-9hx9-hpp9).
Drop the pymysql.converters assertions from test.sh: escape_dict is now
a non-callable placeholder kept only for aiomysql, and upstream states
the module is internal with no compatibility guarantee.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Picks up the 3.18.2 security fixes: GHSA-33wh-fxxf-88vv hardens content
negotiation against large Accept headers, GHSA-3547-9m27-7rxg refuses
non-text encoding charsets, and GHSA-xw6w-gcfp-cf8m makes deleting a
TokenProxy actually delete the token. 3.18.3 then reverts the
order_by_precedence() return value, which 3.18.2 had changed by
mistake.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Security release: CVE-2026-77050 (denial of service in
get_supported_language_variant()), CVE-2026-84429 (denial of service in
parse_header_parameters(), reachable through the Accept and
Content-Type headers), CVE-2026-87890 (request forgery via spatial
lookup byte values) and CVE-2026-87975 (privilege abuse in model
formsets with editable primary keys). It also completes an
insufficient mitigation of CVE-2026-15307 shipped in 6.1.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Single fix: the precision defaults for the e/E format types, added in
2.3.0, were processed wrongly and the formatter emitted its own format
string instead of a number -- format(sin(1), ".10De") returned
"%.10.6RDe" rather than "8.4147098480e-01".
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Hardens the reader against crafted databases: decoding now caps a
record at 65536 values, 512 levels of nesting and 2 MiB of string and
bytes payload, rejects unsigned integers over 16 bytes and signed ones
over 4 bytes before reading their payload, and rejects an invalid
search tree size when opening a database. Those, and the truncated
reads that used to surface as IndexError or struct.error, all raise
InvalidDatabaseError now.
Upstream vendors libmaxminddb 1.14.0 for the same limits in the C
extension; this package links the feed's libmaxminddb instead, so that
half arrives with a libmaxminddb bump.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
4.15.1 raises the typing_extensions requirement marker from
python_version < "3.13" to < "3.15", so it is now a real runtime
dependency on python 3.14 and importing anyio fails without it.
Add python3-typing-extensions to DEPENDS.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
The single change is a new "towncrier-fragments-zerover" version
scheme: like towncrier-fragments, but while the last tag is still 0.x a
breaking or removal fragment bumps the minor version and only a major
fragment proposes 1.0.0. Nothing else moves; this keeps the package in
step with setuptools-scm, which shares its repository.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
The 10.3.x series is a chain of fixes to one regression: 10.3.0 let
version inference return before discovering a workdir, and the egg_info
mixin read that missing workdir as "looked and found no checkout",
which suppressed the setuptools.file_finders chain. Builds then
succeeded with the right version and an sdist and wheel missing every
SCM-tracked file that setuptools' own package discovery does not find.
10.3.3 fixed it for a pretended version, 10.3.4 for projects whose
pyproject.toml sits in a subdirectory of the checkout.
10.3.4 also raises the vcs-versioning floor to 2.5.0, which the feed
already ships.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
The feed reverted python-flit-core to 3.12.0, which satisfies the
upstream "flit_core >=3.11,<4" build requirement, so the relaxation
patch is no longer needed.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
The feed reverted python-flit-core to 3.12.0, which satisfies the
upstream "flit_core<4,>=3.11" build requirement, so the relaxation
patch is no longer needed.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Upstream now caps flit_core at <5, which the feed's 3.12.0 satisfies, so
drop 010-relax-flit-core-constraint.patch.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Upstream now caps flit_core at <5, which the feed's 3.12.0 satisfies, so
drop 010-relax-flit-core-constraint.patch.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Update to the latest upstream release and drop
001-cffi-build-rs-derive-include-from-pyo3-cross.patch, which is
part of this release.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
cryptography 50.0.2 requires "maturin>=1.14.1,<2" as its build
backend, which 1.13.1 does not satisfy.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Refresh sha256 from the PyPI sdist.
26.4.0 drops OpenSSL.crypto.X509Req and dump_certificate_request, so
test.sh can no longer import them; remove them and the CSR block. CSR
handling now lives in cryptography.x509, which is not this package.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
The override lists every python3 package by name, so it has to change
whenever the package set does, and it cannot be used as is on branches
that build a different set, like libpython3-3.13 and python3-email on
openwrt-25.12.
Check the interpreter, python3-dev and libpython3-X.Y against the
version, and accept the standard library modules and -src packages by
pattern, since they ship no executables. python3-dev now gets a real
check through python3-config and patchlevel.h, because python3-config
prints no version.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
libatomic is only needed where the compiler does not inline 64-bit
atomics, but the package depends on it on every target.
ATOMIC64_DEPENDS restricts the dependency to those targets.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Adds support for setuptools 84.
chardet-normalizer has been broken since setuptools 84 was merged in
6211fee354
Signed-off-by: Austin Lane <vidplace7@gmail.com>
Refresh PKG_HASH from the python.org release tarball, and bump
PYTHON3_PIP_VERSION to 26.2.1 to match the pip wheel bundled in 3.14.7's
ensurepip (it already matches the python-pip package version).
Refresh the patches against the new source; only the hunk offsets shift.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
d883c02a41 ("python3: pin host curses to the SDK's narrow ncurses",
2026-05-28) forced every curses header check Python's configure.ac
runs to "no", specifically to keep host ncurses's (then narrow-only)
build from being shadowed by whatever curses headers the build host's
own distro happened to ship under /usr/include.
That assumption broke when openwrt/openwrt@18725c45a3 ("ncurses:
bump to 6.6.20260801") switched host ncurses to track ncurses' git
snapshots rather than the old 6.4 tarball: ncurses 6.6+ defaults to
building wide-character support for ABI 6 (cf_dft_widec, gated on
cf_cv_abi_default which is just the major version - this is a policy
change accumulated in ncurses' own git history since 6.4 was tagged,
not something OpenWrt or ncurses deliberately changed for wide-char
specifically). Host ncurses now produces ncursesw.pc/panelw.pc, which
Python 3.14's configure.ac finds independently via its own
PKG_CHECK_MODULES(CURSES, ncursesw)-style pkg-config probe ("checking
for ncursesw... yes") - a check that was never gated by these ac_cv_*
overrides in the first place. That flips on the wide-character code
paths in Modules/_cursesmodule.c, while the ac_cv_header_ncursesw_*=no
overrides still force the *header* checks to fail, so the actual
#include falls through to the stale narrow ncurses/ncurses.h. The
result is a mismatch between what pkg-config says is available and
what header actually got included, producing:
./Modules/_cursesmodule.c: error: implicit declaration of function
'unget_wch'; did you mean 'ungetch'?
(and similarly for wget_wch, wins_nwstr, mvwins_nwstr - every
wide-character-only curses function).
Fix this at the python3/ncurses integration boundary rather than by
touching ncurses' own host build behaviour globally (see
openwrt/openwrt#24811, which tried --disable-widec on host ncurses
and had to be reverted: it also drops extended colors from host tic,
shrinking MAX_ENTRY_SIZE 32768->4096 so tic can no longer process the
xterm/xterm-256color terminfo entries needed to assemble the target
terminfo package). Since host ncurses's own -I.../include/ncursesw
already gets added via pkg-config's Cflags substitution regardless of
these overrides, stop forcing ac_cv_header_ncursesw_{ncurses,panel}_h
to "no" - configure now genuinely finds ncursesw/ncurses.h in
staging_dir/hostpkg, consistent with what its own pkg-config check
already reports, and both detection paths agree.
ac_cv_header_ncursesw_curses_h stays forced, along with the bare
(non-w) curses.h/ncurses.h/panel.h checks: host ncurses is configured
with --without-curses-h, so staging_dir/hostpkg/include/ncursesw/ has
no curses.h of its own to genuinely detect - a real "yes" here could
only ever come from the build host's own /usr/include/ncursesw/
curses.h (e.g. Fedora's ncurses-devel), the exact distro-shadowing
this override block exists to prevent.
Verified end to end: clean host python3 rebuild against unmodified
current ncurses compiles Modules/_cursesmodule.c and
Modules/_curses_panel.c without error, and the resulting
staging_dir/hostpkg python3.14 successfully `import curses` with
unget_wch present.
Fixes: d883c02a41 ("python3: pin host curses to the SDK's narrow ncurses")
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
userpath adds to and removes from the user's PATH. Its only consumer in
the feed was pipx, which has just been removed, so python-userpath now
has no users. Remove it as well.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
pipx installs and runs Python applications in isolated virtual
environments. That workflow sees little use on OpenWrt's embedded
targets, and keeping the package current has become a recurring
maintenance burden as upstream keeps adding build- and run-time
dependencies to support it. Nothing in the feed depends on pipx, so
remove it.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Refresh sha256 from PyPI sdist. Drop the macOS cross-compile patch;
2.1.1 already carries the sysconfig.get_platform() fix upstream.
Add test-version.sh: 2.1.1 ships the cffi-gen-src console tool, a
subcommand CLI with no version flag, so the generic per-executable
version probe fails the package ("No executables in the package
provided version"). test-version.sh skips that probe, and test.sh now
asserts cffi.__version__ against the packaged version.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Refresh sha256 from the PyPI sdist and refresh 003 for the shifted line.
Retarget 002-pip-runner-pyc-fix.patch instead of dropping it: in 26.2.1
get_runnable_pip() moved from build_env.py (now a package) to
_internal/utils/misc.py. The function is otherwise unchanged and still
returns __pip-runner__.py, so the .pyc fallback is still required. We ship
pip byte-compiled only (the .py sources live in the -src package), so
without it build isolation cannot locate the runner and every PEP 517
install fails on target. This is a packaging workaround, not an upstream
bug, so upstream has no reason to carry it.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Refresh sha256 from PyPI sdist. Upstream renamed the sdist to use an
underscore (pytest_forked-1.7.5.tar.gz), so set PYPI_SOURCE_NAME.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Alexandru Ardelean
Josef Schlehofer
Austin Lane
Daniel Golle
Wei-Ting Yang