Major changes since 3.10.0:
4.0:
- add CORS_ALLOW_PRIVATE_NETWORK setting for Local Network Access spec support
- add async middleware support, reducing overhead on async views
- remove deprecated CORS_REPLACE_HTTPS_REFERER and CorsPostCsrfMiddleware
- remove three header names from default allowed list (accept-encoding, dnt, origin)
4.3:
- fix access-control-allow-credentials header not being omitted on
non-allowed responses
4.6:
- drop support for Django 3.2 through 4.1
4.9:
- add Django 6.0 support
- tighten validation of sequence-type settings (e.g. CORS_ALLOW_METHODS)
Add PYPI_SOURCE_NAME:=django_cors_headers as the 4.x sdist uses
underscores in the filename.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit ccd69a148f)
Update package to 6.0.4.
Security fixes:
- CVE-2026-33033: DoS fix in MultiPartParser -- base64-encoded multipart
uploads with excessive whitespace could cause repeated memory copying
- CVE-2026-3902: ASGI header spoofing fixed -- headers containing underscores
are now ignored by ASGIRequest to prevent hyphen/underscore conflation
attacks
- CVE-2026-4277: Privilege abuse in GenericInlineModelAdmin -- add permissions
on inline model instances were not validated against forged POST data
- CVE-2026-4292: Privilege abuse in ModelAdmin.list_editable -- changelist
forms incorrectly allowed new instances to be created via forged POST data
- CVE-2026-33034: DoS via ASGI memory upload limit bypass -- missing or
understated Content-Length could bypass DATA_UPLOAD_MAX_MEMORY_SIZE
Bug fixes:
- alogin/alogout regression where request.user was not set/cleared if already
materialized by sync middleware
- RelatedFieldWidgetWrapper regression incorrectly wrapping all widgets in a
fieldset in admin forms
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit 06eb22a606)
Changes since 0.4.4:
- v0.5.0: Improved handling of CTEs and window functions
- v0.5.0: Better token classification for SQL dialects
- v0.5.x: Various bug fixes for edge cases in formatting
and statement splitting
Also add test.sh to verify formatting, splitting, and parsing.
Link: https://github.com/andialbrecht/sqlparse/blob/master/CHANGELOG
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit 2eef8732a3)
Verify that asgiref.__version__ strictly equals the expected version
argument ($2), instead of just checking that it is non-empty.
Also remove single quotes from EOF to enable variable expansion.
Signed-off-by: Wei-Ting Yang <williamatcg@gmail.com>
(cherry picked from commit bdab2f1f59)
Changelog: https://github.com/django/asgiref/blob/main/CHANGELOG.txt
Multiple minor/patch releases since 3.7.2 with bug fixes and
Python 3.13+ compatibility improvements. Resets PKG_RELEASE to 1.
Add test.sh to verify async_to_sync and sync_to_async adapters.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit 5a7fbc8303)
Changelog since 0.9.6.1:
- add product version number to the PRODID tag in iCalendar output
- add support for GEO tags in vCards
- various bugfixes and compatibility improvements
Also need to update setup.cfg at build time to insert the version
to allow the package to build.
Otherwise we get
```
2026-04-21T08:17:17.9341927Z File "/builder/staging_dir/hostpkg/lib/python3.14/site-packages/setuptools/config/setupcfg.py", line 296, in __setitem__
2026-04-21T08:17:17.9342520Z parsed = self.parsers.get(option_name, lambda x: x)(value)
2026-04-21T08:17:17.9343117Z File "/builder/staging_dir/hostpkg/lib/python3.14/site-packages/setuptools/config/setupcfg.py", line 602, in _parse_version
2026-04-21T08:17:17.9343777Z return expand.version(self._parse_attr(value, self.package_dir, self.root_dir))
2026-04-21T08:17:17.9344201Z ~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
2026-04-21T08:17:17.9344938Z File "/builder/staging_dir/hostpkg/lib/python3.14/site-packages/setuptools/config/setupcfg.py", line 421, in _parse_attr
2026-04-21T08:17:17.9345544Z return expand.read_attr(attr_desc, package_dir, root_dir)
2026-04-21T08:17:17.9345876Z ~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
2026-04-21T08:17:17.9346409Z File "/builder/staging_dir/hostpkg/lib/python3.14/site-packages/setuptools/config/expand.py", line 191, in read_attr
2026-04-21T08:17:17.9346947Z return getattr(module, attr_name)
2026-04-21T08:17:17.9347261Z AttributeError: module 'vobject' has no attribute 'VERSION'
2026-04-21T08:17:17.9598878Z
```
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit 970bbeb3b5)
On macOS (Darwin) hosts, building host Python C extensions (such as Cython) using the '-shared' flag and linking against '-lpython3.x' causes the host Python interpreter to load a duplicate copy of the Python runtime. This leads to type checking mismatches and segmentation faults (SIGSEGV) when importing the compiled extension.
For example, running:
./staging_dir/hostpkg/bin/python3 -c "import Cython.Utils"
crashes with:
Segmentation fault: 11
To build shared modules correctly on macOS, they must be compiled as bundles using the '-bundle -undefined dynamic_lookup' flags instead of '-shared', and they should not link against the Python library (no '-lpython3.x' in LDFLAGS).
Fix this by dynamically adjusting LDSHARED and LDFLAGS in python3-host.mk when the host OS is Darwin.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit ea541f48b5)
Removing the ncursesw path from include avoids seeing the wide-char
version of ncurses, so the host build picks up the narrow static lib
that the OpenWrt SDK stages. To keep that pin from leaking back in
through other curses headers the build host may have under
/usr/include, also force every header check in Python's configure.ac
AC_CHECK_HEADERS(curses.h ncurses.h ncursesw/ncurses.h
ncursesw/curses.h ncursesw/panel.h panel.h) line to "no" via cached
ac_cv_header_* variables.
The narrow ncursesw_* trio was enough on the original reporter's
host; Jan Kardell's review of the first cut hit a build where
`/usr/include/curses.h` and `/usr/include/ncurses.h` from the
distro's libncurses-dev were still being picked up. Adding the
non-wide entries (and panel.h for symmetry, in case a host also
ships /usr/include/panel.h alone) makes the override insensitive to
whichever curses dev packages the host distro happens to provide.
Reported-by: Jan Kardell <jan.kardell@telliq.com>
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit d883c02a41)
Flup was heavily used in downstream distribution (Turris OS)
for their Web UI - reForis. Since there are no other
dependent packages in this repository, Flup is no longer needed.
The package appears to be abandoned and is no longer maintained
The latest version dates back to 2009.
It was previously required for Seafile.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 5120ed91b8)
Bump to version 0.1.3 and drop patch, which is in upstream.
Signed-off-by: Erik Larsson <who+github@cnackers.org>
(cherry picked from commit fee669b6d4)
The release tarball already contains a pre-generated _version.py with
the version hardcoded, so versioneer is not needed at build time.
Patch pyproject.toml to only require setuptools and remove
PKG_BUILD_DEPENDS:=python-versioneer/host.
Remove python-versioneer package as it is no longer needed.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit 8c3bc3fcf9)
Update package to 3.4.0.
Changes:
- Added binary wheels for RISC-V 64
- Fixed multiple rare crash paths during interpreter shutdown; now uses
the atexit module (subtle API change: getcurrent unavailable once
atexit fires)
- Fixed multiple race conditions in free-threaded (no-GIL) builds when
greenlets are accessed from multiple threads, some causing assertion
failures or interpreter crashes
- Several minor correctness fixes from automated code audit
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit 15e2da047b)
Build is failing for a while now with error:
```
14.3.0_musl/usr/include -I/builder/shared-workdir/build/sdk/staging_dir/toolchain-mipsel_24kc_gcc-14.3.0_musl/include -I/builder/shared-workdir/build/sdk/staging_dir/toolchain-mipsel_24kc_gcc-14.3.0_musl/include/fortify -I/builder/shared-workdir/build/sdk/staging_dir/target-mipsel_24kc_musl/usr/include/python3.14 -fPIC -I/builder/shared-workdir/build/sdk/staging_dir/target-mipsel_24kc_musl/usr/include/python3.14 -c ./ubus_python.c -o build/temp.linux-mipsel-cpython-314/ubus_python.o
./ubus_python.c: In function 'ubus_python_add':
./ubus_python.c:1081:17: error: implicit declaration of function 'PyEval_CallMethod'; did you mean 'PyObject_CallMethod'? [-Wimplicit-function-declaration]
1081 | PyEval_CallMethod(python_alloc_list, "pop", "");
| ^~~~~~~~~~~~~~~~~
| PyObject_CallMethod
error: command '/builder/shared-workdir/build/sdk/staging_dir/toolc
```
This has been fixed on version 0.1.3, but that hasn't been
published to pypi yet.
Also add test.sh
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit 29e685e1f8)
Starting with 46.x, cryptography switched its build backend from
setuptools-rust to maturin. Update PKG_BUILD_DEPENDS accordingly:
replace python-setuptools-rust/host with python-maturin/host and
python-setuptools/host (setuptools is still required by cffi).
Drop 001-Update-ouroboros.patch: the ouroboros crate is no longer a
dependency in 46.x, so the patch (which bumped it from 0.15 to 0.18
to fix RUSTSEC-2023-0042) no longer applies.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit 2d20f8f0dc)
When Python3 was updated via commit 97a92f2e7 , distutils was
disappeared from Python3 and moved to setuptools.
So that patch should have moved here as well.
This should fix all packages which still use the 'build_ext'
module from setuptools.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
v3.17.0 changes:
- Drop Python 3.9 support (minimum now 3.10)
- Drop deprecated coreapi support
- Add Python 3.14 support
- Add ability to specify output format for DurationField
- Add missing decorators: @versioning_class(), @content_negotiation_class(),
@metadata_class() for function-based views
- Support violation messages in UniqueConstraint
Full release notes:
https://github.com/encode/django-rest-framework/releases/tag/3.17.0
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit facb68ee69)
Changelog since 2.2.2:
- Add mpz.array() method for NumPy interaction
- Implement mpq.limit_denominator() functionality
- Add is_integer() method for mpz/mpq types
- Add mixed-mode arithmetic support for mpc types
- Enhanced formatting using context's rounding mode defaults
- Full free-threaded Python build support
- Fix memory leaks in MPFR/MPC cache and context exit
- Drop CPython 3.8 support (requires 3.9+)
Add test.sh.
gmpy2 2.3.0 switched to pyproject.toml with setuptools-scm for version
management. Add python-setuptools-scm/host to PKG_BUILD_DEPENDS.
Full changelog:
https://github.com/aleaxit/gmpy/releases
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit 643e0bd695)
Changelog since 24.7.2:
- Switch build system from wheel to hatchling
- Switch runtime dependency from setuptools/pkg-resources to packaging
- Add CLI script (pipx run incremental)
- Add Python 3.13 and 3.14 support; drop Python 3.8 support
- Drop Click dependency from CLI
Update HOST_BUILD_DEPENDS to use python-hatchling/host instead of
python-wheel/host, and replace +python3-pkg-resources dependency with
+python3-packaging in DEPENDS.
Add test.sh.
Full changelog:
https://github.com/twisted/incremental/releases
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit 6fc55f8b74)
Pillow 12.x introduces pybind11-based C extension bindings and a
custom build backend (wrapping setuptools.build_meta). This requires:
- Replacing python-setuptools-scm with python-setuptools as build dep
- Adding python-pybind11 as a new build dependency (host)
- Updating build config settings from --build-option flags to the new
key=value format (e.g. zlib=enable, imagequant=disable)
- Removing the separate webpmux flag (merged into webp feature)
Full release notes:
https://pillow.readthedocs.io/en/stable/releasenotes/index.html
Remove 001-remove-setuptools-version-limit.patch
That's an old relic since when setuptools was packaged inside Python3
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit df78cf6b01)
pybind11 is a header-only library that exposes C++ types in Python,
used as a build-time dependency by packages like Pillow 12.x.
Uses setuptools as its build backend.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit 432fa809dd)
And disable custom build-backend in order to use setuptools.
Signed-off-by: Jean Thomas <jean.thomas@wifirst.fr>
(cherry picked from commit ef77e07976)
Starting from 1.9.2 python-evdev requires
include/uapi/linux/uinput.h headers for proper building.
Otherwise, it compiles but cannot be imported causing
KeyError: 'UI_FF'
Add uinput.h to LINUX_EVDEV_HEADERS
Signed-off-by: Ivan Belokobylskiy <belokobylskij@gmail.com>
It seems this software is no longer maintained.
The last upstream commit is 4 years ago, and
this software only supports obsolete setup.py.
Users should use supported similar softwares, such
as speedtest-go in packages repo.
Signed-off-by: Yanase Yuki <dev@zpc.st>
(cherry picked from commit 7eea92b91c)
passlib is unmaintained since 2020 and a maintained fork called libpass,
which is a drop-in replacement (even using the passlib module name), is
now available. https://github.com/Kozea/Radicale/issues/1952 has more
information.
Therefore we remove the python-passlib package from this repo.
Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
(cherry picked from commit 3de4d24830)
passlib has not be updated since 2020 and is therefore a dead project.
Radicale (used in this repo as radicale3) has updated to use libpass (a
maintained fork of passlib): https://github.com/Kozea/Radicale/pull/1953
therefore add python3-libpass to provide libpass, a drop-in replacement
for passlib, and a dependency for Radicale v3.6.0.
Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
(cherry picked from commit ead09d5fd9)
- Fixed HTTPResponse.read_chunked() to properly handle leftover data
in the decoder's buffer when reading compressed chunked responses.
- Fixed a security issue where decompression-bomb safeguards of the
streaming API were bypassed when HTTP redirects were followed.
(CVE-2026-21441)
- Started treating Retry-After times greater than 6 hours as 6 hours
by default.
- Fixed urllib3.connection.VerifiedHTTPSConnection on Emscripten.
Release notes:
https://github.com/urllib3/urllib3/releases/tag/2.6.2https://github.com/urllib3/urllib3/releases/tag/2.6.3
Signed-off-by: Wei-Ting Yang <williamatcg@gmail.com>
(cherry picked from commit 295c75a2b9)
Pika is a pure-Python implementation of the AMQP 0-9-1 protocol that
tries to stay fairly independent of the underlying network support
library.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit d8437af213)
Alexandru Ardelean
Wei-Ting Yang
Josef Schlehofer
Erik Larsson
Rosen Penev
Jean Thomas
Ivan Belokobylskiy
Yanase Yuki
Daniel F. Dickinson