Commit Graph

2226 Commits

Author SHA1 Message Date
Oliver Chang
c95ce92989 django: bump to 4.2.20
Update django version to 4.2.20 to solve CVE-2024-53907 and CVE-2024-53908

Signed-off-by: Oliver Chang <oliverchang@nexcom.com.tw>
2025-08-22 17:24:43 +08:00
Austin Lane
a89664e701 python-click: add hostbuild
Signed-off-by: Austin Lane <vidplace7@gmail.com>
(cherry picked from commit 117a3a2b1b)
2025-07-24 18:10:15 +03:00
Josef Schlehofer
bdcdc0e364 python-uci: update to version 0.10.3 + two patches
Release notes:
https://gitlab.nic.cz/turris/pyuci/-/tags/v0.10.0
https://gitlab.nic.cz/turris/pyuci/-/tags/v0.10.1
https://gitlab.nic.cz/turris/pyuci/-/tags/v0.10.2
https://gitlab.nic.cz/turris/pyuci/-/tags/v0.10.3

Upstream (pyuci developers) removed setup.py,
I bring it back to be able to compile it despite
that we do support building packages, which are
using pyproject.toml, but the thing here is
that their pyproject.toml requires setuptools 74.1.0
[1] [2], but Python 3.11 is using bundled setuptools
and pip [3] [4]. In current version 3.11.13,
there is still outdated version of setuptools, but
it looks like that in the newer version, there will be
new one [5].

Once, there is released Python 3.11.14 and updated
in OpenWrt, these patches can be dropped.

[1] 240180b294/pyproject.toml (L29)
[2] https://setuptools.pypa.io/en/stable/history.html#v74-1-0
[3] c94ab433ca/lang/python/python3-version.mk (L18)
[4] https://github.com/python/cpython/commits/3.11/Lib/ensurepip/_bundled
[5] c96ab19ae4

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit d457c26c0d)
2025-07-18 11:35:55 +02:00
Austin Lane
c75de96989 python-urllib3: add hostbuild
Signed-off-by: Austin Lane <vidplace7@gmail.com>
(cherry picked from commit d6c644c5f5)
2025-07-15 15:06:49 +02:00
Alexandru Ardelean
f931a1c973 django: bump to 4.2.16
Fixes a bunch of CVEs.
CVE-2024-45230
  https://nvd.nist.gov/vuln/detail/CVE-2024-45230

CVE-2024-45231
  https://nvd.nist.gov/vuln/detail/CVE-2024-45231

(And maybe a few more).

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2024-11-27 06:31:57 +02:00
Fabrice Fontaine
f24f165765 lang/python/python-paho-mqtt: fix license
python-paho-mqtt is licensed under EPL-2.0, not EPL-1.0, since version
1.6.0 and
fabe7500fb

While at it, add LICENSE.txt to PKG_LICENSE_FILES

Fixes: 784f2a519b (python-paho-mqtt: bump to version 1.6.1)

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
(cherry picked from commit 3380427f29)
2024-07-10 10:39:27 +00:00
Fabrice Fontaine
5934d69086 lang/python/python-docker: assign PKG_CPE_ID
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:docker:docker-py

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
(cherry picked from commit dd52b70c4c)
2024-07-06 10:28:19 -07:00
Fabrice Fontaine
8bb8ac555c lang/python/python-aiohttp: fix PKG_CPE_ID
aiohttp:aiohttp is a better CPE ID than aio-libs_projet:aiohttp as this
CPE ID has the latest CVEs (whereas aio-libs_project:aiohttp only has
one CVE from 2018):
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:aiohttp:aiohttp

Fixes: 2edf5034f1 (python-aiohttp: add a new package)

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
(cherry picked from commit 8b9965fcb3)
2024-07-06 10:28:19 -07:00
Fabrice Fontaine
2f02119888 lang/python/python-urllib3: fix PKG_CPE_ID
There is not a single CVE linked to urllib3_project:urllib3 so use
python:urllib3 instead:
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:python:urllib3

Fixes: 6dcaa769d8 (python-urllib3: update to version 1.25)

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
(cherry picked from commit d369edb571)
2024-07-06 10:28:19 -07:00
Fabrice Fontaine
9c14028de9 lang/python/python-requests: fix PKG_CPE_ID
There is not a single CVE linked to python-requests:requests so use
python:requests instead:
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:python:requests

Fixes: ceadbcbb64 (treewide: add PKG_CPE_ID for cvescanner)

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
(cherry picked from commit c0aec8bc08)
2024-07-06 10:28:19 -07:00
Fabrice Fontaine
866f4dabc3 lang/python/python-pip: fix PKG_CPE_ID
There is not a single CVE linked to python:pip so use pypa:pip instead:
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:pypa:pip

Moreover, CPE_ID missed PKG_ prefix

Fixes: eee273507b (python3: Split pip into separate source package)

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
(cherry picked from commit acad8ffb5f)
2024-07-06 10:28:19 -07:00
Fabrice Fontaine
84d7eb7af2 treewide: assign PKG_CPE_ID
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
[davici: not present in 23.05]
(cherry picked from commit 5afe5c9031)
2024-07-06 10:28:19 -07:00
Fabrice Fontaine
19dd98e9f7 lang/python/python-yaml: fix PKG_CPE_ID
There is not a single CVE linked to pyyaml_project:pyyaml so use
pyyaml:pyyaml instead:
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:pyyaml:pyyaml

Fixes: c06a04c754 (python-yaml: update to version 5.1)

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
(cherry picked from commit 94734c4bf9)
2024-07-06 10:28:19 -07:00
Fabrice Fontaine
bbb20bd572 treewide: fix licence typos
- PKG_LICENCE -> PKG_LICENSE
- PKC_LICENSE_FILES -> PKG_LICENSE_FILES
- BSD 3-Clause -> BSD-3-Clause
- BSD-3-clause -> BSD-3-Clause
- BSD-2-clause -> BSD-2-Clause
- Public Domain -> Public-Domain
- PublicDomain -> Public-Domain
- Drop unneeded ',' in PKG_LICENSE or PKG_LICENSE_FILES

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
(cherry picked from commit 820fcc5fb9)
2024-07-06 10:28:19 -07:00
Alexandru Ardelean
063b2393cb django: bump to version 4.2.11
Addresses a bunch of CVEs.
A more recent one: https://nvd.nist.gov/vuln/detail/CVE-2024-24680

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2024-03-19 13:40:40 +01:00
Quintin Hill
db28d99be9 python-ble2mqtt: update to 0.2.2
b3b0cc8 version 0.2.2
85515cd roidmi: initial support for NEX2 Pro
62addc2 isort imports
8695649 README: update other govee to govee_ht
33f6ade ruuvitag: remove device class for counter
2099607 Rename key govee->govee_ht
12acacd codestyle updates
dbba43d ruuvitag: drop redundant import
84878e0 base: add and use HumidityTemperatureSensor
e9f0046 xiaomi_lywsd03_atc: make send_custom a class variable
2f4809a base: use lowercase for instance variable
5b1af17 govee: add manufacturer
7891691 ruuvitag: add manufacturer
cfd799b ruuvitag: remove inheritance from SubscribeAndSetDataMixin
7be28a1 codestyle updates
bffcf5e Add Govee H5074 temperature/humidity sensor support (#77)

Signed-off-by: Quintin Hill <stuff@quintin.me.uk>
(cherry picked from commit 268ed6d347)
2024-02-04 16:10:23 -08:00
Quintin Hill
c2ae7b95df python-dbus-fast: upgrade to 2.21.1
fix: avoid expensive runtime inspection of known callables (https://github.com/Bluetooth-Devices/dbus-fast/pull/277)
Signed-off-by: Quintin Hill <stuff@quintin.me.uk>
(cherry picked from commit 8db974d8eb)
2024-02-04 16:10:23 -08:00
Andy Syam
1167ef72ea python-dbus-fast: update version 2.21.0
Signed-off-by: Andy Syam <privasisource@gmail.com>
(cherry picked from commit 81a5b89c96)
Signed-off-by: Quintin Hill <stuff@quintin.me.uk>
2024-01-28 16:29:36 +08:00
Quintin Hill
e6d3a7892f python3-bleak: add missing python3-typing-extensions dependency
Dependency introduced by 21094e67cf
and
3c1fac9773

(And only for python versions below 3.12.)

Fixes: 64fa106 (python3-bleak: bump version to 0.21.1)

Signed-off-by: Quintin Hill <stuff@quintin.me.uk>
(cherry picked from commit fcb02c264b)
2024-01-28 16:29:36 +08:00
Alexandru Ardelean
f971d88d5d django: bump to version 4.2.8
To address
   https://nvd.nist.gov/vuln/detail/CVE-2023-43665

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2023-12-28 13:40:17 -08:00
Tianling Shen
77583c7dbf Merge pull request #22888 from jefferyto/python-3.11.7-openwrt-23.05
[openwrt-23.05] python3: Update to 3.11.7, refresh patches
2023-12-16 17:20:21 +08:00
Jeffery To
40a730516c python3: Update to 3.11.7, refresh patches
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit d4f5759190)
2023-12-14 01:36:41 +08:00
Quintin Hill
c82697da69 python3-ble2mqtt: bump version to 0.2.1
Signed-off-by: Quintin Hill <stuff@quintin.me.uk>
(cherry picked from commit 0937af539d)
2023-12-11 23:26:57 +00:00
Quintin Hill
bb3a340200 python3-bleak: bump version to 0.21.1
Signed-off-by: Quintin Hill <stuff@quintin.me.uk>
(cherry picked from commit 64fa106b07)
2023-12-11 23:26:54 +00:00
Quintin Hill
5c9de3c0a2 python3-dbus-fast: bump version to 2.20.0
Signed-off-by: Quintin Hill <stuff@quintin.me.uk>
(cherry picked from commit ca2171c005)
2023-12-11 23:26:46 +00:00
Jeffery To
4fa89ac516 python-cryptography: Update to 41.0.7
41.0.6 included a fix for CVE-2023-49083 (loading certificates from a
PKCS#7 bundle could lead to a null-pointer-dereference and segfault).

Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 5f829ad162)
2023-12-08 22:44:26 +08:00
Jeffery To
672a209367 python-cryptography: Update to 41.0.5
This also adds a CPE ID for the package and updates the test.sh script
to use an assert.

Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit c4a223ed87)
2023-12-08 22:44:26 +08:00
Eneas U de Queiroz
f9b6c2c5de pymysql: add meta-package for sha256 support
Replace the PYTHON3_PYMYSQL_SHA_PASSWORD_SUPPORT option, which is
causing circular dependencies, with a meta-package that installs both
python3-pymysql and python3-cryptography.

Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit 79b173a0c5)
2023-11-16 08:44:13 +02:00
Jeffery To
66774c3b30 pyodbc: Fix segmentation fault
4.0.36 included a change to decimal parsing[1] that requires the decimal
module. Trying to load the pyodbc module without python3-decimal
installed would lead to a segmentation fault.

This adds python3-decimal as a dependency.

This also adds python3-uuid as a dependency as the module can accept and
return uuid objects[2].

[1]: 6b107a2bca
[2]: 2ad7a9ced7

Fixes: f02f3ee8c7 ("pyodbc: Update to 4.0.39")

Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 668a0f9dd8)
2023-11-02 11:23:38 +01:00
Jeffery To
f218d96e14 python3: Fix building C extensions with setuptools
setuptools provides a local copy of distutils and when building a C
extension, this distutils will add the target LIBDIR (/usr/lib) to the
list of library paths.

If the build system has a libpython3.11.so in /usr/lib, then the linker
will try to link to this shared library and fail.

This adapts 008-distutils-use-python-sysroot.patch for host setuptools
to add the correct library directory.

Fixes: https://github.com/openwrt/packages/issues/22330

Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 624fb95561)
2023-11-02 00:40:44 +08:00
Christian Marangi
a566154dff micropython-lib: move to PCRE2
Add pending patch converting the package to PCRE2.

Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit d191c3d0c4)
2023-10-23 09:59:50 +02:00
Tianling Shen
416a1b6cdd Merge pull request #22375 from jefferyto/python-zope-interface-6.1-openwrt-23.05
[openwrt-23.05] python-zope-interface: Update to 6.1, refresh patch
2023-10-16 09:01:32 +08:00
Jeffery To
6544ab791e python-setuptools-rust: Set cargo profile from environment variable
This adds a patch (submitted upstream in
https://github.com/PyO3/setuptools-rust/pull/364), to read the profile
to pass to cargo from an environment variable.

This also updates the Python include files to set the environment
variable based on values from rust-values.mk.

Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 29ca9797a6)
2023-10-12 14:04:00 +08:00
Jeffery To
185f27789c rust: Consolidate cargo environment variables
This consolidates all environment variables for cargo into:

* CARGO_HOST_CONFIG_VARS / CARGO_PKG_CONFIG_VARS

  These contain all cargo-specific environment variables, i.e. without
  "common" variables like CC.

* CARGO_HOST_VARS / CARGO_PKG_VARS (renamed from CARGO_VARS)

  These contain all environment variables to be passed to cargo.

This also:

* Set the CARGO_BUILD_TARGET environment variable instead of using the
  --target command-line option

* Update Python include files to use CARGO_HOST_CONFIG_VARS /
  CARGO_PKG_CONFIG_VARS

Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 9db7284d58)
2023-10-12 14:00:30 +08:00
Jeffery To
c3247d59e8 rust: Install to $(STAGING_DIR)/host
This allows rustc/cargo/etc to be called without having to set PATH, as
$(STAGING_DIR)/host/bin is already in PATH.

This also fixes CARGO_HOME not being set during Host/Configure and
Host/Compile.

Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 49aaf19c65)
2023-10-12 13:59:53 +08:00
Jeffery To
12be20d0c8 python-zope-interface: Update to 6.1, refresh patch
This also updates the list of dependencies and adds a test.sh script for
the packages feed CI.

Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 7e8f7b28d7)
2023-10-12 13:53:32 +08:00
Jeffery To
bec2e7fc81 python3: Update to 3.11.6, refresh patches
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 2aba43afe9)
2023-10-11 09:10:19 +02:00
Josef Schlehofer
fb9265747b Merge pull request #22293 from jefferyto/python-charset-normalizer-3.3.0-openwrt-23.05
[openwrt-23.05] python-charset-normalizer: Update to 3.3.0
2023-10-10 10:08:19 +02:00
Josef Schlehofer
c6d5e3e96f Merge pull request #22326 from jefferyto/python-twisted-23.8.0-openwrt-23.05
[openwrt-23.05] python-twisted: Update to 23.8.0, rework patches
2023-10-08 09:00:20 +02:00
Eneas U de Queiroz
15cfd52f14 python3: avoid unnecessary rebuilds
Move the order in which BuildPackage is called, so that the libpython
package is built ahead of the module packages, to avoid forcing a
clean-build of the package when 'make package/python3/compile' is called
a second time without changes.

The library must be built first, so that when the buildsystem checks for
ABI version changes using libpython3.version, its timestamp should be
older than the dependent package's STAMP_PREPARED file.

Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit c230d7bd7f)
2023-10-07 19:33:08 +02:00
Jeffery To
9f6eb89ea0 python-twisted: Update to 23.8.0, rework patches
The package changed to the hatchling build backend.

Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 00841f9873)
2023-10-07 19:52:32 +08:00
Jeffery To
c5f6b62fdf python-cffi: Update to 1.16.0
This includes a patch to unpin the version of setuptools required for
build; the required version is newer than the version bundled with
Python 3.11. This patch should not be necessary when Python 3.12 is
available.

Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit dd5af62695)
2023-10-04 17:05:27 +02:00
Jeffery To
4c4fa3cd21 python-packaging: Update to 23.2
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 78bcdd0fd1)
2023-10-04 17:05:01 +02:00
Jeffery To
8620abe6ad python-bcrypt: Update to 4.0.1, add myself as maintainer
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 6b3da46777)
2023-10-03 21:28:46 -07:00
Jeffery To
36a473bf52 python-pyopenssl: Update to 23.2.0
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit bb278a015c)
2023-10-03 21:28:36 -07:00
Jeffery To
71f226e032 python-charset-normalizer: Update to 3.3.0
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 85540346fe)
2023-10-04 11:13:44 +08:00
Jeffery To
88ef5d0ba4 python-typing-extensions: Update to 4.8.0
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit cb8648679b)
2023-10-02 19:15:29 +08:00
Jeffery To
66958cef9f python-trove-classifiers: Update to 2023.9.19
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 423235b40a)
2023-10-02 19:15:23 +08:00
Jeffery To
191d367d1b python-setuptools: Update to 68.2.2
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit c12e4e873d)
2023-10-02 19:15:14 +08:00
Jeffery To
4ed41a0cbe python-cryptography: Update to 41.0.4
This includes a patch to update the version of ouroboros (Rust crate)
used, to fix RUSTSEC-2023-0042[1]. Upstream has switch from ouroboros to
self_cell so this patch should only be necessary for cryptography 41.

[1]: https://rustsec.org/advisories/RUSTSEC-2023-0042.html

Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 9fdff3ea94)
2023-10-02 19:15:02 +08:00