Upstream lists a single change for this release, support for Python
3.15, so this only keeps the package current; the free-threading fixes
to the C lookup caches are queued for 8.7 and are not in it.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
0.5.7 renames the sdist's top directory from python-gnupg-0.5.7 to
python_gnupg-0.5.7, so set PYPI_SOURCE_NAME to make PKG_BUILD_DIR match
what the tarball extracts to. pypi.mk then derives the same PKG_SOURCE
that the explicit line held, so drop it.
Add 001-relax-setuptools-constraint.patch: 0.5.7 tightens its build
requirement to "setuptools >= 68,<75", which the feed's setuptools
84.0.0 does not satisfy, so the build fails with an unmet
"setuptools<75,>=68" dependency. The cap is precautionary and the
package builds unchanged without it.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
1.2.1 fixes a SQL injection via wrongly escaped bytes parameters on the
big5, gbk, sjis, cp932 and gb18030 charsets (GHSA-x4f8-9hx9-hpp9).
Drop the pymysql.converters assertions from test.sh: escape_dict is now
a non-callable placeholder kept only for aiomysql, and upstream states
the module is internal with no compatibility guarantee.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Picks up the 3.18.2 security fixes: GHSA-33wh-fxxf-88vv hardens content
negotiation against large Accept headers, GHSA-3547-9m27-7rxg refuses
non-text encoding charsets, and GHSA-xw6w-gcfp-cf8m makes deleting a
TokenProxy actually delete the token. 3.18.3 then reverts the
order_by_precedence() return value, which 3.18.2 had changed by
mistake.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Security release: CVE-2026-77050 (denial of service in
get_supported_language_variant()), CVE-2026-84429 (denial of service in
parse_header_parameters(), reachable through the Accept and
Content-Type headers), CVE-2026-87890 (request forgery via spatial
lookup byte values) and CVE-2026-87975 (privilege abuse in model
formsets with editable primary keys). It also completes an
insufficient mitigation of CVE-2026-15307 shipped in 6.1.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Single fix: the precision defaults for the e/E format types, added in
2.3.0, were processed wrongly and the formatter emitted its own format
string instead of a number -- format(sin(1), ".10De") returned
"%.10.6RDe" rather than "8.4147098480e-01".
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Hardens the reader against crafted databases: decoding now caps a
record at 65536 values, 512 levels of nesting and 2 MiB of string and
bytes payload, rejects unsigned integers over 16 bytes and signed ones
over 4 bytes before reading their payload, and rejects an invalid
search tree size when opening a database. Those, and the truncated
reads that used to surface as IndexError or struct.error, all raise
InvalidDatabaseError now.
Upstream vendors libmaxminddb 1.14.0 for the same limits in the C
extension; this package links the feed's libmaxminddb instead, so that
half arrives with a libmaxminddb bump.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
4.15.1 raises the typing_extensions requirement marker from
python_version < "3.13" to < "3.15", so it is now a real runtime
dependency on python 3.14 and importing anyio fails without it.
Add python3-typing-extensions to DEPENDS.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
The single change is a new "towncrier-fragments-zerover" version
scheme: like towncrier-fragments, but while the last tag is still 0.x a
breaking or removal fragment bumps the minor version and only a major
fragment proposes 1.0.0. Nothing else moves; this keeps the package in
step with setuptools-scm, which shares its repository.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
The 10.3.x series is a chain of fixes to one regression: 10.3.0 let
version inference return before discovering a workdir, and the egg_info
mixin read that missing workdir as "looked and found no checkout",
which suppressed the setuptools.file_finders chain. Builds then
succeeded with the right version and an sdist and wheel missing every
SCM-tracked file that setuptools' own package discovery does not find.
10.3.3 fixed it for a pretended version, 10.3.4 for projects whose
pyproject.toml sits in a subdirectory of the checkout.
10.3.4 also raises the vcs-versioning floor to 2.5.0, which the feed
already ships.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
The feed reverted python-flit-core to 3.12.0, which satisfies the
upstream "flit_core >=3.11,<4" build requirement, so the relaxation
patch is no longer needed.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
The feed reverted python-flit-core to 3.12.0, which satisfies the
upstream "flit_core<4,>=3.11" build requirement, so the relaxation
patch is no longer needed.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Upstream now caps flit_core at <5, which the feed's 3.12.0 satisfies, so
drop 010-relax-flit-core-constraint.patch.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Upstream now caps flit_core at <5, which the feed's 3.12.0 satisfies, so
drop 010-relax-flit-core-constraint.patch.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Update to the latest upstream release and drop
001-cffi-build-rs-derive-include-from-pyo3-cross.patch, which is
part of this release.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
cryptography 50.0.2 requires "maturin>=1.14.1,<2" as its build
backend, which 1.13.1 does not satisfy.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Lua stopped shipping a pkg-config file after 5.1; the 5.2, 5.3 and 5.4
release tarballs contain none. Distributions add one to their Lua
packages instead: Debian's liblua5.4-dev ships lua5.4.pc, lua-5.4.pc
and lua54.pc, Alpine's lua5.4-dev ships lua5.4.pc and lua-5.4.pc. Build
systems of Lua consumers look Lua 5.4 up under these names. The package
stages no pkg-config file so far, so such builds cannot find
liblua5.4; the only Lua pkg-config file in the staging directory is
lua.pc of the lua package (5.1.5).
Stage lua5.4.pc, generated from a template with the package version,
and lua-5.4.pc and lua54.pc as links to it. It points to the headers in
/usr/include/lua5.4 and to liblua5.4, and lists libm and libdl as
private libraries for static linking, as the upstream Makefile links
them on Linux.
Of the packages that look up one of these names through pkg-config,
libinput disables its Lua plugin support explicitly in the previous
commit. tio looks up lua-5.4 before lua but depends on lua (5.1), so it
links liblua5.4 without depending on it until the next commit moves it
to Lua 5.4. The others select their Lua version explicitly, look up lua
(5.1) first, build without the feature using Lua, or depend on lua5.4
already.
Assisted-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Mirko Vogt <mirko-openwrt@nanl.de>
luaconf.h builds the module search paths out of LUA_ROOT, which upstream
hardcodes to /usr/local, where nothing installs on OpenWrt. LUA_ROOT is
defined unconditionally, but the two macros it feeds, LUA_PATH_DEFAULT
and LUA_CPATH_DEFAULT, are both guarded with #if !defined and are the
only users of it, so set them in TARGET_CFLAGS and drop the patch.
The resulting paths are the ones the patch produced, so the interpreter
behaves exactly as before.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
The three Lua variants of each package install the same files, differing
only in the destination directory, so define LUA_INSTALL_DIR next to the
other per-variant settings and share a single install recipe. Same idiom
as luafilesystem, luasec and luaexpat. No packaged path changes.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Commit 3fe92e63f5 moved the default Lua 5.4 module search paths
from /usr/local to /usr. luaossl still staged and packaged its Lua 5.4
modules under /usr/local/lib/lua/5.4, outside the default search paths.
Set lua54path and lua54cpath to /usr/lib/lua/5.4 and update the package
install rules to match. Bump PKG_RELEASE to 3 so the corrected package
is offered as an upgrade. Keep Lua 5.1 and Lua 5.3 paths unchanged.
Fixes: 3fe92e63f5 ("lua: look for lua5.4 modules under /usr instead of /usr/local")
Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>
Commit 3fe92e63f5 moved the default Lua 5.4 module search paths
from /usr/local to /usr. cqueues still staged and packaged its Lua 5.4
modules under /usr/local/lib/lua/5.4, outside the default search paths.
Set lua54path and lua54cpath to /usr/lib/lua/5.4 and update the package
install rules to match. Bump PKG_RELEASE to 3 so the corrected package
is offered as an upgrade. Keep Lua 5.1 and Lua 5.3 paths unchanged.
Fixes: 3fe92e63f5 ("lua: look for lua5.4 modules under /usr instead of /usr/local")
Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>
Commit 3fe92e63f5 ("lua: look for lua5.4 modules under /usr instead of
/usr/local") changed LUA_ROOT to /usr/, moving the default Lua 5.4
module search paths out of /usr/local. The Lua 5.4 variant of lua-ffi
still installed ffi.so under /usr/local/lib/lua/5.4, so require("ffi")
could no longer find it with the default search paths.
Install ffi.so under /usr/lib/lua/5.4 to match the new default search
path. Bump PKG_RELEASE to 2 so the corrected package is offered as an
upgrade. Keep the Lua 5.1 and Lua 5.3 installation paths unchanged.
Fixes: 3fe92e63f5 ("lua: look for lua5.4 modules under /usr instead of /usr/local")
Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>
Commit 3fe92e63f5 ("lua: look for lua5.4 modules under /usr instead of
/usr/local") changed LUA_ROOT to /usr/, moving the default Lua 5.4
module search paths out of /usr/local. The Lua 5.4 variant of lua-cjson
still installed cjson.so under /usr/local/lib/lua/5.4, so require("cjson")
could no longer find it with the default search paths.
Install cjson.so under /usr/lib/lua/5.4 to match the new default search
path. Bump PKG_RELEASE to 6 so the corrected package is offered as an
upgrade. Keep the Lua 5.1 and Lua 5.3 installation paths unchanged.
Fixes: 3fe92e63f5 ("lua: look for lua5.4 modules under /usr instead of /usr/local")
Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>
Commit 3fe92e63f5 ("lua: look for lua5.4 modules under /usr instead of
/usr/local") changed LUA_ROOT to /usr/, moving the default Lua 5.4
module search paths out of /usr/local. lua-eco still installed its Lua
and native modules under /usr/local/lib/lua/5.4, so require() could no
longer find them with the default search paths.
Install modules from the main package and all subpackages under
/usr/lib/lua/5.4, which is searched for both .lua and .so files.
Define LUA_INSTALL_DIR once and use it throughout the install rules so
future directory changes only need one update. Bump PKG_RELEASE to 2
so the corrected packages are offered as upgrades.
Fixes: 3fe92e63f5 ("lua: look for lua5.4 modules under /usr instead of /usr/local")
Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>
Refresh sha256 from the PyPI sdist.
26.4.0 drops OpenSSL.crypto.X509Req and dump_certificate_request, so
test.sh can no longer import them; remove them and the CSR block. CSR
handling now lives in cryptography.x509, which is not this package.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
The override lists every python3 package by name, so it has to change
whenever the package set does, and it cannot be used as is on branches
that build a different set, like libpython3-3.13 and python3-email on
openwrt-25.12.
Check the interpreter, python3-dev and libpython3-X.Y against the
version, and accept the standard library modules and -src packages by
pattern, since they ship no executables. python3-dev now gets a real
check through python3-config and patchlevel.h, because python3-config
prints no version.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Config parameters grabbed from standard libraries and existing Perl
build tree. Tested good on both glibc and musl with simple scripts.
Signed-off-by: Xinhui Yang <cyan@cyano.uk>
curl 8.22.0 removes TLS-SRP support. Explicitly set
PECL_cv_LIBCURL_TLSAUTH_SRP=no to prevent configure from
running a test that fails when cross-compiling.
Signed-off-by: Peter Polonec <polonec.devel@pm.me>
The open-coded architecture list pulls libatomic onto ARMv6K and ARMv7
targets although they inline 64-bit atomics, and still names the
removed arc architecture. ATOMIC64_DEPENDS covers exactly the targets
that need it.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
libatomic is only needed where the compiler does not inline 64-bit
atomics, but the package depends on it on every target.
ATOMIC64_DEPENDS restricts the dependency to those targets.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
PHP's configure script probes __atomic_exchange_1 as an external
function on riscv64, which only resolves against libatomic, and so
links the library although no binary references an atomic symbol.
The riscv64-only dependency and linker flag paper over that. Link
with --as-needed so the unused library is dropped and remove both;
mips and riscv64 builds import no atomic symbols.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Refresh PKG_HASH from the tag tarball. Upstream moved from
keplerproject to lunarmodules and the 2.7.0 tag has no leading v;
point PKG_SOURCE_URL and the homepage URL at lunarmodules.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Alexandru Ardelean
Mirko Vogt
Jianhui Zhao
Josef Schlehofer
Xinhui Yang
Peter Polonec
Austin Lane
Daniel Golle
Wei-Ting Yang
George Sapkin