Update to v18.17.1
This is a security release.
Notable Changes
The following CVEs are fixed in this release:
* CVE-2023-32002: Policies can be bypassed via Module._load (High)
* CVE-2023-32006: Policies can be bypassed by module.constructor.createRequire (Medium)
* CVE-2023-32559: Policies can be bypassed via process.binding (Medium)
* OpenSSL Security Releases (Depends on shared library provided by OpenWrt)
* OpenSSL security advisory 14th July.
* OpenSSL security advisory 19th July.
* OpenSSL security advisory 31st July
Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
On host PC using GCC 13, stackctrl.c fails to compile
with the following error:
../py/stackctrl.c: In function 'mp_stack_ctrl_init':
../py/stackctrl.c:32:32: error: storing the address of
local variable 'stack_dummy'
in 'mp_state_ctx.thread.stack_top' [-Werror=dangling-pointer=]
32 | MP_STATE_THREAD(stack_top) = (char *)&stack_dummy;
../py/stackctrl.c:31:18: note: 'stack_dummy' declared here
31 | volatile int stack_dummy;
| ^~~~~~~~~~~
In file included from ../py/runtime.h:29,
from ../py/stackctrl.c:27:
../py/mpstate.h:296:23: note: 'mp_state_ctx' declared here
296 | extern mp_state_ctx_t mp_state_ctx;
| ^~~~~~~~~~~~
cc1: all warnings being treated as errors
Fixed accordingly by ignoring -dangling-pointer warning
inside mp_stack_ctrl_init function.
Signed-off-by: Jean-Paul Etienne <fractalclone@gmail.com>
Version 1.71.1 (2023-08-03)
===========================
- Fix CVE-2023-38497: Cargo did not respect the umask when extracting dependencies
- Fix bash completion for users of Rustup
- Do not show `suspicious_double_ref_op` lint when calling `borrow()`
- Fix ICE: substitute types before checking inlining compatibility
- Fix ICE: don't use `can_eq` in `derive(..)` suggestion for missing method
- Fix building Rust 1.71.0 from the source tarball
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
Includes fix for CVE-2023-29409 (crypto/tls: verifying certificate
chains containing large RSA keys is slow).
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
This loads the module, which should return the path of the CA bundle
and verifies that the file exists.
Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
This renames the source package to python-sqlparse to match other Python
packages.
This also updates the build dependencies; package now uses the flit-core
build backend.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
From the README:
frozenlist.FrozenList is a list-like structure which implements
collections.abc.MutableSequence. The list is mutable until
FrozenList.freeze is called, after which list modifications raise
RuntimeError.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
From the README:
A library that helps you read text from an unknown charset encoding.
Motivated by chardet, I'm trying to resolve the issue by taking a new
approach. All IANA character set names for which the Python core library
provides codecs are supported.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
This renames the source package to python-pyroute2 to match other Python
packages.
This also updates/simplifies the package dependencies.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
Notable Changes:
*Ada 2.0
Node.js v18.17.0 comes with the latest version of the URL parser, Ada. This update brings significant performance improvements to URL parsing, including enhancements to the url.domainToASCII and url.domainToUnicode functions in node:url.
*Web Crypto API
Web Crypto API functions' arguments are now coerced and validated as per their WebIDL definitions like in other Web Crypto API implementations. This further improves interoperability with other implementations of Web Crypto API.
Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
When user runs `make clean` command, everything in `$(STAGING_DIR)`
(where we installed rust) will be removed, but `$(BUILD_DIR_HOST)`
(where we compiled rust and stored build stage) is untouched.
So when user starts a new build after that, OpenWrt buildroot will
still consider `rust` is installed already, resulting the build error
"cargo: command not found".
Fix this by moving to target build dir as well.
Fixes: f489e019ac ("rust: compile host package per target")
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
Hirokazu MORIKAWA
Josef Schlehofer
Jeffery To
Jean-Paul Etienne
Tianling Shen
Eneas U de Queiroz
Alexandru Ardelean