Commit Graph

5066 Commits

Author SHA1 Message Date
Fabrice Fontaine
da53869fb2 python/python-eventlet: assign PKG_CPE_ID
cpe:/a:eventlet:eventlet is the correct CPE ID for python-eventlet:
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:eventlet:eventlet

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
2026-03-20 18:54:38 +02:00
Alexandru Ardelean
e7e16a8597 python-build: bump to 1.4.0
Changelog since 1.3.0:
- v1.3.0: Add --config-json for JSON-based configuration; drop Python 3.8
  support; fix ModuleNotFoundError when pip isn't installed
- v1.4.0: Add --quiet flag for silent operation; add --metadata option to
  dump PEP 517 metadata; add support for UV environment variable;
  improve Python 3.14 compatibility

Full changelog:
https://github.com/pypa/build/releases

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-03-20 15:43:10 +02:00
Alexandru Ardelean
5f957ab5d3 python-setuptools: bump to 82.0.1
Changelog since 80.9.0:
- v81.0.0: Remove --dry-run parameter from setup.py
- v82.0.0: Remove pkg_resources module (deprecated since 67.5.0);
  users should migrate to importlib.resources / importlib.metadata
- v82.0.1: Fix loading of launcher manifest.xml file; documentation
  improvements for installing source distributions

Since pkg_resources has been removed in v82.0.0, drop the
python3-pkg-resources sub-package and remove it as a dependency
from python3-setuptools.

Full changelog:
https://github.com/pypa/setuptools/releases

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-03-20 15:26:50 +02:00
Alexandru Ardelean
01d1c66135 python-hatchling: bump to 1.29.0
Changelog since 1.27.0:
- v1.27.0: Update default version of core metadata to 2.4
- v1.28.0: Drop Python 3.9 support; add sbom-files option and
  sbom_files build data to wheel build target for SBOM file inclusion
- v1.29.0: Fix Source Date Epoch handling for dates before 1980

Full changelog:
https://github.com/pypa/hatch/releases

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-03-20 15:26:31 +02:00
Alexandru Ardelean
161d07e436 python-click: bump to 8.3.1
Changelog since 8.1.7:
- v8.1.8: Fix type hints for open_file(); fix multiline error messages
  for invalid Path; restore empty string defaults in help text
- v8.2.0: Drop Python 3.7-3.9 support; switch to pyproject.toml/flit_core;
  redesign shell completion system (Bash 4.4+, Zsh, Fish);
  add ProgressBar(hidden) parameter
- v8.2.1: Fix flag value handling for flag options with explicit types;
  fix shell completion for nested groups
- v8.2.2: Fix default/flag_value/type parameter reconciliation; fix Zsh
  completion for items containing colons
- v8.3.0: Rework flag_value and default parameters; enable default on
  Argument with nargs=-1; enhance Fish shell autocompletion
- v8.3.1: Fix pager argument handling; fix prompt rendering with empty
  prompt_suffix; fix parameter conversion timing issues

Add test.sh.

Full changelog:
https://github.com/pallets/click/releases

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-03-20 15:26:09 +02:00
Alexandru Ardelean
f22ab5cf66 python3: bump to 3.14.3
Major version bump from 3.13.9 to 3.14.3.

Highlights of Python 3.14:
- PEP 649: Deferred evaluation of annotations
- PEP 750: Template string literals (t-strings)
- PEP 758: Exception syntax simplification (no brackets needed)
- PEP 765: Restrict control flow in finally blocks
- PEP 779: Official free-threaded mode support
- PEP 784: Zstandard compression module
- UUID versions 6-8 support with faster generation
- Formally verified HMAC implementation
- Experimental JIT compiler support
- Tail-call interpreter option for performance

Full release notes:
https://www.python.org/downloads/release/python-3143/

Dropped 100-test_hashlib-better-handle-support-for-SHA3.patch (upstreamed)
Adapted 027-fix-host-build-libressl.patch (for
X509_VERIFY_PARAM_get_hostflags() )

Refreshed other patches.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-03-20 15:25:40 +02:00
Fabrice Fontaine
6f5a3f76b7 python/python-wheel: assign PKG_CPE_ID
cpe:/a:wheel_project:wheel is the correct CPE ID for python-wheel:
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:wheel_project:wheel

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
2026-03-19 14:45:11 +02:00
Fabrice Fontaine
8ba27ceef9 lang/chicken-scheme: assign PKG_CPE_ID
cpe:/a:call-cc:chicken is the correct CPE ID for chicken-scheme:
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:call-cc:chicken

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
2026-03-19 14:37:50 +02:00
Alexandru Ardelean
3a31ea37bb python-eventlet: bump to 0.40.4
Full release notes:
https://github.com/eventlet/eventlet/blob/master/NEWS

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-03-19 12:45:20 +02:00
Alexandru Ardelean
5358179573 python-userpath: bump to 1.9.2
Full release notes:
https://github.com/ofek/userpath/releases/tag/v1.9.2

Add a bit more testing.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-03-18 12:03:04 +02:00
Fabrice Fontaine
bfdf014967 lang/erlang: fix PKG_CPE_ID
cpe:/a:erlang:erlang\/otp is the correct CPE ID for erlang:
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:erlang:erlang%5C/otp

Fixes: 299e5b0a9b (treewide: add PKG_CPE_ID for better cvescanner coverage)

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
2026-03-18 09:05:09 +01:00
Fabrice Fontaine
a7f33871e9 python-pyopenssl: fix PKG_CPE_ID
cpe:/a:pyopenssl:pyopenssl is the correct CPE ID for python-pyopenssl:
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:pyopenssl:pyopenssl

Fixes: ceadbcbb64 (treewide: add PKG_CPE_ID for cvescanner)

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
2026-03-15 15:53:18 +02:00
Fabrice Fontaine
fa203c818f lang/rust: assign PKG_CPE_ID
cpe:/a:rust-lang:rust is the correct CPE ID for rust:
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:rust-lang:rust

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
2026-03-15 09:08:57 +02:00
Alexandru Ardelean
c65017be6a python-mako: bump to 1.3.5
Changelog since 1.3.0:
- Fix escaped percent signs (%%) not rendering correctly when not at
  line beginnings (1.3.1/1.3.2)
- Add 'pass' statements to empty control blocks to prevent errors (1.3.3)
- Fix strict_undefined mode conflicts with comprehensions inside
  function definitions (1.3.3)
- Revert dictionary literal parsing changes that caused bracketed
  expression regressions (1.3.5)

Full changelog:
https://docs.makotemplates.org/en/latest/changelog.html

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-03-15 09:01:59 +02:00
Alexandru Ardelean
27b6ad53b9 treewide: add Alexandru Ardelean as co-maintainer
Add 'Alexandru Ardelean <ardeleanalex@gmail.com>' as co-maintainer
alongside Jan Pavlinec <jan.pavlinec1@gmail.com> for all packages
where Jan Pavlinec is listed as maintainer.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-03-14 10:51:33 +02:00
Alexandru Ardelean
6e014ede19 python-chardet: bump to 7.0.1
Full release notes:
https://github.com/chardet/chardet/releases/tag/7.0.1

Add 'python3-codecs' as dependency. No idea when (or if) this was
ever needed, but it became obvious after test.sh was added.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-03-14 10:22:59 +02:00
Alexandru Ardelean
6e95bdf1b9 python-pytz: bump to 2026.1
Updated timezone data to 2026.1 release.

Full release notes:
https://github.com/stub42/pytz/blob/master/src/CHANGES.rst

pytz 2026.1 requires setuptools as build backend but it was not
declared as a build dependency, causing the build to fail with
'setuptools.build_meta:__legacy__ is not available'.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-03-13 21:30:10 +02:00
Javier Marcet
1b59cb61a7 luajit2: update to v2.1-20260227
For changes, see tagged commit:
https://github.com/openresty/luajit2/releases/tag/v2.1-20260227

Signed-off-by: Javier Marcet <javier@marcet.info>
2026-03-13 20:00:49 +02:00
Jeffery To
376cbe460a treewide: remove myself as maintainer
slide-switch is my software, I choose to continue to be sole maintainer.
(This was also the case in #28429.)

Signed-off-by: Jeffery To <jeffery.to@gmail.com>
2026-03-14 01:53:21 +08:00
Rosen Penev
f04aa8389d python-pyodbc: update to 5.3.0
Fixes compilation with newer Python/

Signed-off-by: Rosen Penev <rosenp@gmail.com>
2026-03-13 19:51:41 +02:00
Alexandru Ardelean
a7e01c91b6 treewide: add me as co-maintainer to Jeffery's packages
Add 'Alexandru Ardelean <ardeleanalex@gmail.com>' as co-maintainer
alongside Jeffery To <jeffery.to@gmail.com> for all packages where
Jeffery To is listed as maintainer.

Supersedes PR: https://github.com/openwrt/packages/pull/28429

We can have another PR where Jeffery removes himself later.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-03-13 19:04:53 +02:00
Alexandru Ardelean
68f18ae0ef numpy: bump to 2.4.2
Changelog:
- Fix memory leaks
- Fix validation of contraction axes in tensordot
- Fix free-threaded PyObject layout bugs
- Fix thread safety in array_getbuffer
- Fix quantile promotion logic
- Fix compatibility with latest Cython version
- Update OpenBLAS to fix hanging issues

Full release notes:
https://github.com/numpy/numpy/releases/tag/v2.4.2

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-03-13 09:34:28 +02:00
Ivan Belokobylskiy
1e8de4500c python-evdev: bump version to 1.9.3
Fix several memory leaks in input.c

Signed-off-by: Ivan Belokobylskiy <belokobylskij@gmail.com>
2026-03-12 15:56:00 +02:00
Ivan Belokobylskiy
b016aa38c3 python-evdev: add mandatory uinput.h header to builder
Starting from 1.9.2 python-evdev requires
include/uapi/linux/uinput.h headers for proper building.
Otherwise, it compiles but cannot be imported causing
KeyError: 'UI_FF'

Add uinput.h to LINUX_EVDEV_HEADERS

Signed-off-by: Ivan Belokobylskiy <belokobylskij@gmail.com>
2026-03-12 15:56:00 +02:00
Rosen Penev
3f727dfd0c python-psycopg2: update to 2.9.11
Newer Python compatibility.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
2026-03-11 18:54:49 +01:00
Tianling Shen
ff826adfa8 rust: Update to 1.94.0
Changelog:
- https://github.com/rust-lang/rust/releases/tag/1.91.1
- https://github.com/rust-lang/rust/releases/tag/1.92.0
- https://github.com/rust-lang/rust/releases/tag/1.93.0
- https://github.com/rust-lang/rust/releases/tag/1.93.1
- https://github.com/rust-lang/rust/releases/tag/1.94.0

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2026-03-12 00:52:21 +08:00
Wei-Ting Yang
d1923a44fd django: bump to version 6.0.3
Fix CVE-2026-25674.

Full release notes:
https://docs.djangoproject.com/en/6.0/releases/6.0.3/

Signed-off-by: Wei-Ting Yang <williamatcg@gmail.com>
2026-03-11 13:52:18 +02:00
Wei-Ting Yang
551fe9b9b6 django: clean up Makefile
- Add AUTHORS into PKG_LICENSE_FILES.
- Drop no longer required python3-pytz dependency.
- Remove obsolete CONFLICTS field.

Signed-off-by: Wei-Ting Yang <williamatcg@gmail.com>
2026-03-11 13:52:18 +02:00
George Sapkin
ddb2995ef0 golang: bump 1.26 to 1.26.1
Fixes: CVE-2026-25679
Fixes: CVE-2026-27137
Fixes: CVE-2026-27138
Fixes: CVE-2026-27139
Fixes: CVE-2026-27142
Changes: https://github.com/golang/go/issues?q=milestone%3AGo1.26.1+label%3ACherryPickApproved
Signed-off-by: George Sapkin <george@sapk.in>
2026-03-07 01:15:09 +02:00
George Sapkin
b284c4de94 golang: remove broken mirror
Remove dl.google.com mirror because it's not responding.

Signed-off-by: George Sapkin <george@sapk.in>
2026-03-07 01:15:09 +02:00
Orne Brocaar
4c3a649dd7 rust: set llvm.download-ci-llvm=false
These LLVM builds get deleted after a certain time, causing Rust builds
to break as the LLVM build can no longer be downloaded.

Fixes #27331.

Signed-off-by: Orne Brocaar <info@brocaar.com>
2026-03-06 00:38:44 +02:00
Rosen Penev
3c32225190 python-gmpy2: update to 2.2.2
Fixes compilation.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
2026-02-23 15:14:17 +07:00
Wei-Ting Yang
f7e3317515 treewide: fix licenses
Fix licenses.

Signed-off-by: Wei-Ting Yang <williamatcg@gmail.com>
2026-02-19 20:15:36 +02:00
Rosen Penev
126562da30 python-gevent: use LF for Makefile
Done with all other Makefiles.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
2026-02-14 14:58:44 +02:00
Rosen Penev
1d3b5f7791 python-gevent: update to 25.9.1
Fixes compilation.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
2026-02-14 14:58:44 +02:00
George Sapkin
e9e8502f78 golang: replace 1.25 with to 1.26.0
Replace golang1.25 with golang1.26 with version 1.26.0.

Update OS/arch combinations.

Bump bootstrap to 1.24.13.

Link: https://go.dev/doc/go1.26
Link: https://github.com/openwrt/packages/pull/28552
Signed-off-by: George Sapkin <george@sapk.in>
2026-02-11 13:24:21 +02:00
Wei-Ting Yang
b54cc9b69e django: bump to version 6.0.2
Release notes:
https://docs.djangoproject.com/en/dev/releases/6.0/
https://docs.djangoproject.com/en/dev/releases/6.0.1/
https://docs.djangoproject.com/en/dev/releases/6.0.2/

Signed-off-by: Wei-Ting Yang <williamatcg@gmail.com>
2026-02-06 19:59:56 +02:00
George Sapkin
5065a2ff8f golang: bump 1.25 to 1.25.7
Fixes: CVE-2025-61732
Fixes: CVE-2025-68121
Changes: https://github.com/golang/go/issues?q=milestone%3AGo1.25.7+label%3ACherryPickApproved
Signed-off-by: George Sapkin <george@sapk.in>
2026-02-05 22:04:26 +02:00
George Sapkin
e013778bac golang: add support for release candidates
Support building release candidates by setting GO_VERSION_RC to the
release candidate number, e.g. GO_VERSION_RC:=2, and unsetting
GO_VERSION_PATCH.

Signed-off-by: George Sapkin <george@sapk.in>
2026-02-05 22:04:26 +02:00
George Sapkin
35303fb1ab golang: add missing 386 and arm64 suffixes
Add missing 386 and arm64 suffixes to -installsuffix so as not to
accidentally mix incompatible binaries.

Signed-off-by: George Sapkin <george@sapk.in>
2026-02-05 22:04:26 +02:00
George Sapkin
1eaa1f848b golang: use upstream OS/arch format
Use OS/arch format used by Go and reported by go tool dist list.

Update OS/arch combinations.

Signed-off-by: George Sapkin <george@sapk.in>
2026-02-05 22:04:26 +02:00
George Sapkin
9d8ac9df17 golang: add option to skip building bootstrap
Introduce a new configuration option - GOLANG_BUILD_BOOTSTRAP - that
defaults to enabled:

- When enabled, build the local bootstrap instead of using an external
  one for host Go. If GOLANG_EXTERNAL_BOOTSTRAP_ROOT is set, skip the
  initial 1.4 step.

- When disabled, let Go auto-detect the toolchain or use the toolchain
  specified in GOLANG_EXTERNAL_BOOTSTRAP_ROOT to skip building the
  bootstrap and build host Go using that toolchain directly. Configured
  toolchain must be compatible with the current version of Go.

HOST_BUILD_DEPENDS cannot be conditional, so some Makefile juggling is
needed.

Put menu config under bootstrap only.

Remove unnecessary package-related flags from host-only bootstrap.

Signed-off-by: George Sapkin <george@sapk.in>
2026-02-04 08:56:32 +02:00
George Sapkin
5657eb0e2e golang: split src into separate packages
Split misc sources and test data into separate packages. Reduces target
src package size by a third.

Move architecture-dependent generated source from src to the main
package.

Mark doc, misc, src and tests packages with PKGARCH:=all as they don't
have any architecture-specific files.

Fix stripping and strip compiler only.

Fixes: c137c382 ("golang: new packages")
Link: https://github.com/openwrt/packages/pull/28445
Suggested-by: Jeffery To <jeffery.to@gmail.com>
Signed-off-by: George Sapkin <george@sapk.in>
2026-02-02 10:10:03 +02:00
George Sapkin
6f4155c0a0 golang: install into lib instead of share
Installing into share and symlinking to lib breaks tests:

--- FAIL: TestAllDependencies (0.01s)

    moddeps_test.go:49: findGorootModules didn't find the well-known module "std"

--- FAIL: TestDependencyVersionsConsistent (0.00s)

    moddeps_test.go:356: findGorootModules didn't find the well-known module "std"

Install into lib directly instead.

Fixes: c137c382 ("golang: new packages")
Link: https://github.com/openwrt/packages/pull/28445
Signed-off-by: George Sapkin <george@sapk.in>
2026-02-02 10:10:03 +02:00
George Sapkin
a6e94447f7 golang: fix missing dependency check
Add libraries used in test data to extra_provides to pass dependency
checks in package-pack.

Remove unnecessary dependencies.

Fixes: https://github.com/openwrt/packages/issues/27633
Fixes: b2119465 ("golang: Update to 1.24.0")
Link: https://github.com/openwrt/packages/pull/28445
Signed-off-by: George Sapkin <george@sapk.in>
2026-02-02 10:10:03 +02:00
George Sapkin
4396682602 golang: fix generating zbootstrap
Fix setting architecture-specific defaults in zbootstrap.go.

Fixes: b2119465 ("golang: Update to 1.24.0")
Link: cce90c1eeb
Link: https://github.com/openwrt/packages/pull/28445
Suggested-by: Jeffery To <jeffery.to@gmail.com>
Signed-off-by: George Sapkin <george@sapk.in>
2026-02-02 10:10:03 +02:00
George Sapkin
d7e97387d1 golang: don't set GO_LDSO
Don't set GO_LDSO as it's determined automatically at link time.

Link: https://github.com/golang/go/issues/54197
Link: https://github.com/openwrt/packages/pull/28445
Suggested-by: Jeffery To <jeffery.to@gmail.com>
Signed-off-by: George Sapkin <george@sapk.in>
2026-02-02 10:10:03 +02:00
George Sapkin
97566a8308 golang: avoid expanding Makefile variables
Replace Makefile variables in comments to avoid expanding them
unnecessarily.

Link: https://github.com/openwrt/packages/pull/28445
Signed-off-by: George Sapkin <george@sapk.in>
2026-02-02 10:10:03 +02:00
Daniel F. Dickinson
4cb00fd5fb python3: error on host python path too long
Error if shebang to host python interpreter would exceed 127 characters
(124 characters plus shebang and newline). This is used to alert user
when python-installer would fail to correctly set a Python program's
shebang line.

Closes: https://github.com/openwrt/packages/issues/28310

Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
2026-01-26 09:16:08 +02:00
George Sapkin
8958c991c9 golang: add generic package definition
Move version definition to a helper file so multiple versions can be
easily defined using it.

Variables HOST_GO_VARS, PKG_GO_ASMFLAGS, PKG_GO_GCFLAGS,
PKG_GO_INSTALL_ARGS, PKG_GO_LDFLAGS, PKG_GO_VARS, and
PKG_GO_ZBOOTSTRAP_MODS are defined using conditional variable
assignment and can be overridden for each go version.

Link: https://github.com/openwrt/packages/pull/28309
Signed-off-by: George Sapkin <george@sapk.in>
2026-01-25 19:23:45 +02:00